As a client you typically call the login() on theLoginContext that in turn invokes login() on the configured stack of LoginModules.
LoginContext javadoc -
However, a LoginContext should not be used to authenticate more than one Subject. A separate LoginContext should be used toauthenticate each different Subject.
LoginModule javadoc -
The LoginContext is responsible for reading the Configuration and instantiating the appropriate LoginModules.
So, assuming that you create LoginContext instance when somebody accesses it and that its ThreadSafe (you dont hold on to it after the method call etc), then every instantiation of LoginContext s'd result in the LoginModule getting instantiated . I just checked the LoginContext code, it seems to be instantiating the LoginModule everytime the LoginContext is instantiated. So if the login() is in the same method call, i think you s'd be ok. The LoginContext would be per thread and so would be the login module.
[ July 21, 2005: Message edited by: Karthik Guru ]