You can't in 2.x. In 3.x or 4.x you can write a login module that supplies the user/pw from a secure source. Look at the ConfiguredIdentityLoginModule or CallerIdentityLoginModule for starters. You will have to figure out how to get the user/pw from a secure store. Since others have occasionally requested this kind of functionality, if you submit your results I will add it to cvs. You might get a security review also;-)