Index: jbosssx/src/main/java/org/jboss/security/auth/spi/UsernamePasswordLoginModule.java
===================================================================
--- jbosssx/src/main/java/org/jboss/security/auth/spi/UsernamePasswordLoginModule.java	(revision 114443)
+++ jbosssx/src/main/java/org/jboss/security/auth/spi/UsernamePasswordLoginModule.java	(working copy)
@@ -28,6 +28,8 @@
 import java.util.HashMap;
 import java.util.Map;
 
+import javax.management.MalformedObjectNameException;
+import javax.management.ObjectName;
 import javax.security.auth.Subject;
 import javax.security.auth.callback.Callback;
 import javax.security.auth.callback.CallbackHandler;
@@ -69,14 +71,17 @@
    private static final String LEGACY_CREATE_PASSWORD_HASH = "legacyCreatePasswordHash";
    private static final String THROW_VALIDATE_ERROR = "throwValidateError";
    private static final String INPUT_VALIDATOR = "inputValidator";
-	
+   private static final String SECURITY_DOMAIN_OPT = "jaasSecurityDomain";
+   private static final String STORE_PASSWORD_ENCRYPTED = "storePasswordEncrypted";
+
    private static final String[] ALL_VALID_OPTIONS =
       {
 	     HASH_ALGORITHM,HASH_ENCODING,HASH_CHARSET,
 	     HASH_STORE_PASSWORD,HASH_USER_PASSWORD,
 	     DIGEST_CALLBACK,STORE_DIGEST_CALLBACK,
 	     IGNORE_PASSWORD_CASE,LEGACY_CREATE_PASSWORD_HASH,
-	     THROW_VALIDATE_ERROR,INPUT_VALIDATOR
+	     THROW_VALIDATE_ERROR,INPUT_VALIDATOR,
+         SECURITY_DOMAIN_OPT,STORE_PASSWORD_ENCRYPTED
 	  };
    
    /** The login identity */
@@ -109,7 +114,12 @@
 
    /** The input validator instance used to validate the username and password supplied by the client. */
    private InputValidator inputValidator = null;
-   
+
+   /** The JAAS Security Domain to use. */
+   private ObjectName securityDomain;
+   /** A flag indicating if the store password should be decrypted using the securityDomain */
+   private boolean storePasswordEncrypted;
+
    /** Override the superclass method to look for the following options after
     first invoking the super version.
     @param options :
@@ -131,6 +141,9 @@
       implementation that includes pre/post digest content like salts for hashing
       the store/expected password. Only used if hashStorePassword or hashUserPassword is true and
       hashAlgorithm has been specified.
+    option: securityDomain - the JAAS Security Domain to use.
+    option: storePasswordEncrypted - A flag indicating if the store password should be decrypted
+      using the securityDomain.
     */
    @Override
    public void initialize(Subject subject, CallbackHandler callbackHandler,
@@ -162,6 +175,8 @@
       ignorePasswordCase = Boolean.valueOf(flag).booleanValue();
       flag = (String) options.get(HASH_STORE_PASSWORD);
       hashStorePassword = Boolean.valueOf(flag).booleanValue();
+      flag = (String) options.get(STORE_PASSWORD_ENCRYPTED);
+      storePasswordEncrypted = Boolean.valueOf(flag).booleanValue();
       flag = (String) options.get(HASH_USER_PASSWORD);
       if( flag != null )
          hashUserPassword = Boolean.valueOf(flag).booleanValue();
@@ -185,6 +200,18 @@
             this.log.debug("Unable to instantiate input validator class: " + flag);
          }
       }
+      flag = (String) options.get(SECURITY_DOMAIN_OPT);
+      if( flag != null )
+      {
+         try
+         {
+            securityDomain = new ObjectName(flag);
+         }
+         catch(MalformedObjectNameException e)
+         {
+            this.log.debug("Invalid JAAS security domain name: " + flag);
+         }
+      }
    }
 
    /** Perform the authentication of the username and password.
@@ -228,7 +255,7 @@
       String[] info = getUsernameAndPassword();
       String username = info[0];
       String password = info[1];
-      
+
       // validate the retrieved username and password.
       if(this.inputValidator != null)
       {
@@ -263,11 +290,28 @@
          // Hash the user entered password if password hashing is in use
          if( hashAlgorithm != null && hashUserPassword == true )
             password = createPasswordHash(username, password, DIGEST_CALLBACK);
+
          // Validate the password supplied by the subclass
          String expectedPassword = getUsersPassword();
+
+         if( securityDomain != null && storePasswordEncrypted == true )
+         {
+            try
+            {
+               char[] tmp = DecodeAction.decode(expectedPassword, securityDomain);
+               expectedPassword = new String(tmp);
+            }
+            catch (Exception e)
+            {
+               log.debug("Failed to decode stored password", e);
+               throw new LoginException("Failed to decode stored password: " + e.getMessage() );
+            }
+         }
+
          // Allow the storeDigestCallback to hash the expected password
          if( hashAlgorithm != null && hashStorePassword == true )
             expectedPassword = createPasswordHash(username, expectedPassword, STORE_DIGEST_CALLBACK);
+
          if( validatePassword(password, expectedPassword) == false )
          {
             Throwable ex = getValidateError();
