At the moment the ModuleOptions map maps the Kerberos short name to the com.sun LoginModule, instead map to the JBoss Negotation KerberosLoginModule which adds two new capabilities: -
1 - Wrap instantiation of whichever module is actually available.
Note: It does not translate options from one to the other so those are still JDK specific.
2 - Adds an addGSSCredential option so that the module will add a GSSCredential to the Subject.
This part is needed where the returned Subject is then going to be used with JCA.