I think we can improve this code by being explicit about using the file config implementation of Configuration. This will also remove the need to do any mucking around with System properties. Let's use Configuration#getInstance and set the parameters according to http://docs.oracle.com/javase/6/docs/technotes/guides/security/StandardNames.html#Configuration and http://docs.oracle.com/javase/6/docs/api/javax/security/auth/login/Configuration.html#getInstance(java.lang.String, javax.security.auth.login.Configuration.Parameters)

So it should look like: `Configuration.getInstance("JavaLoginConfig", new URIParameter(new URI(loginConfigurationFile)))`

This has the benefits of:

1. Being explicit that we're using a config file
2. Throwing an exception if the JVM doesn't have the config file implementation
3. No side effects, so it's a pure function and we can get rid of the `synchronized`

Does that make sense?