Since all concrete implementations of the CredentialHandler interface are located in the impl package, it's impossible for a developer to programmatically configure a credential handler option using the getCredentialHandlersConfig() method without changing the scope of the picketlink-idm-impl package to compile. Let's fix this by making the Map a simple <String,Object> map and allocating unique names for the option values, possibly with a distinct prefix for each CredentialHandler implementation.