See JBAS-6392. Rather than have a special context factory for not doing the Jaas silly stuff and then a separate variety for each protocol, Make the LoginInitialContextFactory should be able to take a jndi.subfactory property with a "real" InitialContextFactory classname. After LoginInitialContextFactory does like HttpNamingContextFactory does (as described in 6392) it should check for this property and instead of calling super, it should just delegate to that subfactory. In this way it can authenticate without requiring all the Jaas plumbing and yet still speak whatever protocol is required. The principal and credential should be squelched to the child factories.