Please take a review at https://bugs.openjdk.java.net/browse/JDK-8193916 I'm thinking about file an issue https://github.com/javaee/glassfish/issues requesting for the removal of javax.security.auth.Policy-related code. Is that good? Thanks Max