The LoginContext is responsible for reading the Configuration and instantiating the appropriate LoginModules.
So, assuming that you create LoginContext instance when somebody accesses it and that its ThreadSafe (you dont hold on to it after the method call etc), then every instantiation of LoginContext s'd result in the LoginModule getting instantiated . I just checked the LoginContext code, it seems to be instantiating the LoginModule everytime the LoginContext is instantiated. So if the login() is in the same method call, i think you s'd be ok. The LoginContext would be per thread and so would be the login module.
[ July 21, 2005: Message edited by: Karthik Guru ]