Somehow I'm not surprised that the one from IBM didn't work. You see, WebSphere only uses JAAS for the interface seen by the _client_. What really happens behind the scenes, is that IBM uses its own UserRegistry classes to actually check the users' passwords, associate them with the user groups, etc.

Short story is that unless all you want to do is log into a WebSphere server, you can forget about IBM's JAAS classes. All of them are basically around the same level of functionality as JBoss's client loging module.

That said, no, I have never needed to check the users against an NT domain. _If_ you know how to get that information from NT, I'd assume that wrapping it up in a JAAS module can't be that hard.