Java EE 6 on Glassfish 3.1 CallbackHandler throws NullPointerException
public class PasswordSafeLoginModule implements LoginModule {

    private Subject subject;
    private CallbackHandler callbackHandler;
    private Object sharedState;
    private Object options;

    private Set<Principal> principalsAdded;
    private boolean authenticated;
    private String username;
    private String password;

    @Override
    public void initialize(Subject subject, CallbackHandler callbackHandler,
            Map<String, ?> sharedState, Map<String, ?> options) {
        this.subject = subject;
        this.callbackHandler = callbackHandler;
        this.sharedState = sharedState;
        this.options = options;

    }

    @Override
    public boolean abort() throws LoginException {
        // TODO
        return true;
    }

    @Override
    public boolean commit() throws LoginException {
        // TODO
        return false;
    }

    @Override
    public boolean login() throws LoginException {
        NameCallback nameCB = new NameCallback("Username");
        PasswordCallback passwordCB = new PasswordCallback("Password", true);
        Callback[] callbacks = new Callback[] { nameCB, passwordCB };
        try {
            callbackHandler.handle(callbacks);
            // Authenticate username/password
            username = nameCB.getName();
            password = String.valueOf(passwordCB.getPassword());
            //
            // lookup credentials
            //
            // TODO...
            return true;
        } catch (IOException e) {
            throw new LoginException(e.getMessage());
        } catch (UnsupportedCallbackException e) {
            throw new LoginException(e.getMessage());
        }
    }

    @Override
    public boolean logout() throws LoginException {
        logger.info("Logging out '" + username + "'...");
        return false;
    }
}

@Singleton
@Startup
public class PasswordSafeJAASConfiguration extends Configuration {

    /**
     * This method just registers the configuration after the construction.
     */
    @PostConstruct
    void init() {
        Configuration.setConfiguration(this);
    }

    @Override
    public AppConfigurationEntry[] getAppConfigurationEntry(
            String applicationName) {
        AppConfigurationEntry[] entries = new AppConfigurationEntry[1];
        entries[0] = new AppConfigurationEntry(
                PasswordSafeLoginModule.class.getName(),
                LoginModuleControlFlag.REQUIRED, new HashMap<String, Object>());
        return entries;
    }
}

<form method="POST" action="j_security_check">
    <h:messages />
    <h:panelGrid columns="2" columnClasses="rightAlign,leftAlign">
        <h:outputText value="Email address:" />
        <h:inputText id="j_username" required="true" size="8">
            <f:validator validatorId="emailAddressValidator" />
            <f:validateLength minimum="5" maximum="128" />
        </h:inputText>
        <h:outputText value="Password:" />
        <h:inputText id="j_password" required="true" size="8" />
    </h:panelGrid>
    <h:commandButton value="Login..." />
</form>

Caused by: javax.security.auth.login.LoginException: java.lang.NullPointerException
    at com.sun.enterprise.security.auth.login.common.ServerLoginCallbackHandler.handle(ServerLoginCallbackHandler.java:109)
    at javax.security.auth.login.LoginContext$SecureCallbackHandler$1.run(LoginContext.java:955)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.login.LoginContext$SecureCallbackHandler.handle(LoginContext.java:951)
    at com.puresol.passwordsafe.jaas.PasswordSafeLoginModule.login(PasswordSafeLoginModule.java:70)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
[...]

FacesContext context = FacesContext.getCurrentInstance();
HttpServletRequest request = (HttpServletRequest) context
        .getExternalContext().getRequest();
request.login(login.getEmail(), login.getPassword());

Caused by: javax.security.auth.login.LoginException: java.lang.NullPointerException
    at com.sun.enterprise.security.auth.login.common.ServerLoginCallbackHandler.handle(ServerLoginCallbackHandler.java:109)
    at javax.security.auth.login.LoginContext$SecureCallbackHandler$1.run(LoginContext.java:955)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.login.LoginContext$SecureCallbackHandler.handle(LoginContext.java:951)
    at com.puresol.passwordsafe.jaas.PasswordSafeLoginModule.login(PasswordSafeLoginModule.java:70)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
[...]