For your statement (1), we address the issue via "sunchronized" in the method. However, we could slightly improved the code by using storm configuration only. See the code below.

The code only work if the default JAAS Configuration Provider is used. We could avoid such a limitation
by provide our own implementation of javax.security.auth.login.Configuration. The implementation will essentially be a copy of sun's ConfigFile.java (see http://www.docjar.com/html/api/com/sun/security/auth/login/ConfigFile.java.html).  Should we do that?

    public static synchronized Configuration GetConfiguration(Map storm_conf) {
        //try to find login file from Storm configuration  
        String loginConfigurationFile = (String)storm_conf.get("java.security.auth.login.config");

        Configuration login_conf = null;
        if ((loginConfigurationFile != null) && (loginConfigurationFile.length()>0)) { 
            //retrieve system property 
            String orig_loginConfigurationFile = System.getProperty("java.security.auth.login.config");

            //use javax.security.auth.login.Configuration to obtain login configuration object
            //login.Configuration depends on system property "java.security.auth.login.config"
            //(see http://docs.oracle.com/javase/6/docs/jre/api/security/jaas/spec/com/sun/security/auth/login/ConfigFile.html)
            System.setProperty("java.security.auth.login.config", loginConfigurationFile);
            Configuration.setConfiguration(null);
            login_conf =  Configuration.getConfiguration();
            
            //we reset system property to previous value if any
            if (orig_loginConfigurationFile!=null)
                System.setProperty("java.security.auth.login.config", orig_loginConfigurationFile);
            else 
                System.setProperty("java.security.auth.login.config", "");
        }
        return login_conf;
    }