SECURITY-26 has a need for the MBean services and other security related integration aspects for the JBAS to get back into the AS workspace. I see an issue with the Ldapxxx login modules having a reliance on the DecodeAction privileged action, that internally used to call the JaasSecurityDomain mbean service to decode a b64 string. Now since the JaasSecurityDomain mbean service was the central source of the various jsse/crypto settings, we need to get away from this model and use the static SecurityConfiguration as the sink for the security settings. This static SecurityConfiguration can be populated from JaasSecurityDomain Mbean service, the security deployer or wherever.

There certainly has to be a better way than the static SecuriytConfiguration. For now, it is sufficient.