diff --git a/pom.xml b/pom.xml
index e129707..51d34ce 100644
--- a/pom.xml
+++ b/pom.xml
@@ -158,6 +158,19 @@
             <scope>provided</scope>
         </dependency>
 
+        <dependency>
+            <groupId>org.apache.jackrabbit</groupId>
+            <artifactId>oak-core</artifactId>
+            <version>1.0.0</version>
+            <optional>true</optional>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.felix</groupId>
+            <artifactId>org.apache.felix.jaas</artifactId>
+            <version>0.0.2</version>
+            <optional>true</optional>
+        </dependency>
+
         <!-- Test Dependencies -->
         <dependency>
             <groupId>junit</groupId>
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index 6343b04..d14c8c6 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -36,6 +36,7 @@
 import javax.servlet.http.HttpSession;
 
 import org.apache.commons.codec.binary.Base64;
+import org.apache.felix.jaas.LoginModuleFactory;
 import org.apache.felix.scr.annotations.Component;
 import org.apache.felix.scr.annotations.Deactivate;
 import org.apache.felix.scr.annotations.Properties;
@@ -56,6 +57,8 @@
 import org.apache.sling.auth.core.spi.AuthenticationInfo;
 import org.apache.sling.auth.core.spi.DefaultAuthenticationFeedbackHandler;
 import org.apache.sling.auth.form.FormReason;
+import org.apache.sling.auth.form.impl.jaas.FormCredentials;
+import org.apache.sling.auth.form.impl.jaas.JaasHelper;
 import org.apache.sling.commons.osgi.OsgiUtil;
 import org.osgi.framework.BundleContext;
 import org.osgi.framework.Constants;
@@ -73,7 +76,12 @@
     @Property(name = Constants.SERVICE_DESCRIPTION, value = "Apache Sling Form Based Authentication Handler"),
     @Property(name = AuthenticationHandler.PATH_PROPERTY, value = "/", cardinality = 100),
     @Property(name = AuthenticationHandler.TYPE_PROPERTY, value = HttpServletRequest.FORM_AUTH, propertyPrivate = true),
-    @Property(name = Constants.SERVICE_RANKING, intValue = 0, propertyPrivate = false) })
+    @Property(name = Constants.SERVICE_RANKING, intValue = 0, propertyPrivate = false),
+
+    @Property(name = LoginModuleFactory.JAAS_CONTROL_FLAG, value = "sufficient"),
+    @Property(name = LoginModuleFactory.JAAS_REALM_NAME, value = "jackrabbit.oak"),
+    @Property(name = LoginModuleFactory.JAAS_RANKING, intValue = 1000)
+})
 @Service
 public class FormAuthenticationHandler extends DefaultAuthenticationFeedbackHandler implements AuthenticationHandler {
 
@@ -295,6 +303,8 @@
      */
     private boolean loginAfterExpire;
 
+    private JaasHelper jaasHelper;
+
     /**
      * Extracts cookie/session based credentials from the request. Returns
      * <code>null</code> if the handler assumes HTTP Basic authentication would
@@ -622,7 +632,13 @@
 
         final AuthenticationInfo info = new AuthenticationInfo(
             HttpServletRequest.FORM_AUTH, userId);
-        info.put(attrCookieAuthData, authData);
+
+        if (jaasHelper.enabled()) {
+            //JcrResourceConstants.AUTHENTICATION_INFO_CREDENTIALS
+            info.put("user.jcr.credentials", new FormCredentials(userId, authData));
+        } else {
+            info.put(attrCookieAuthData, authData);
+        }
 
         return info;
     }
@@ -643,6 +659,8 @@
             if (data instanceof String) {
                 return (String) data;
             }
+        } else if (credentials instanceof FormCredentials){
+            return ((FormCredentials) credentials).getAuthData();
         }
 
         // no SimpleCredentials or no valid attribute
@@ -653,7 +671,7 @@
         return getCookieAuthData(credentials) != null;
     }
 
-    boolean isValid(final Credentials credentials) {
+    public boolean isValid(final Credentials credentials) {
         String authData = getCookieAuthData(credentials);
         if (authData != null) {
             return tokenStore.isValid(authData);
@@ -679,6 +697,7 @@
 
         Dictionary<?, ?> properties = componentContext.getProperties();
 
+        this.jaasHelper = new JaasHelper(this, componentContext.getBundleContext(), properties);
         this.loginForm = OsgiUtil.toString(properties.get(PAR_LOGIN_FORM),
             AuthenticationFormServlet.SERVLET_PATH);
         log.info("Login Form URL {}", loginForm);
@@ -730,12 +749,14 @@
         this.tokenStore = new TokenStore(tokenFile, sessionTimeout, fastSeed);
 
         this.loginModule = null;
-        try {
-            this.loginModule = FormLoginModulePlugin.register(this,
-                componentContext.getBundleContext());
-        } catch (Throwable t) {
-            log.info("Cannot register FormLoginModulePlugin. This is expected if Sling LoginModulePlugin services are not supported");
-            log.debug("dump", t);
+        if (!jaasHelper.enabled()) {
+            try {
+                this.loginModule = FormLoginModulePlugin.register(this,
+                        componentContext.getBundleContext());
+            } catch (Throwable t) {
+                log.info("Cannot register FormLoginModulePlugin. This is expected if Sling LoginModulePlugin services are not supported");
+                log.debug("dump", t);
+            }
         }
 
         this.includeLoginForm = OsgiUtil.toBoolean(properties.get(PAR_INCLUDE_FORM), DEFAULT_INCLUDE_FORM);
@@ -745,6 +766,11 @@
 
     @Deactivate
     protected void deactivate() {
+        if (jaasHelper != null){
+            jaasHelper.close();
+            jaasHelper = null;
+        }
+
         if (loginModule != null) {
             loginModule.unregister();
             loginModule = null;
diff --git a/src/main/java/org/apache/sling/auth/form/impl/jaas/FormCredentials.java b/src/main/java/org/apache/sling/auth/form/impl/jaas/FormCredentials.java
new file mode 100644
index 0000000..6f127fc
--- /dev/null
+++ b/src/main/java/org/apache/sling/auth/form/impl/jaas/FormCredentials.java
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.sling.auth.form.impl.jaas;
+
+import javax.jcr.Credentials;
+
+public class FormCredentials implements Credentials {
+    private final String userId;
+    private final String authData;
+
+    public FormCredentials(String userId, String authData) {
+        this.userId = userId;
+        this.authData = authData;
+    }
+
+    public String getUserId() {
+        return userId;
+    }
+
+    public String getAuthData() {
+        return authData;
+    }
+}
diff --git a/src/main/java/org/apache/sling/auth/form/impl/jaas/FormLoginModule.java b/src/main/java/org/apache/sling/auth/form/impl/jaas/FormLoginModule.java
new file mode 100644
index 0000000..e98ddf1
--- /dev/null
+++ b/src/main/java/org/apache/sling/auth/form/impl/jaas/FormLoginModule.java
@@ -0,0 +1,102 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.sling.auth.form.impl.jaas;
+
+import java.util.Collections;
+import java.util.Set;
+
+import javax.jcr.Credentials;
+import javax.jcr.SimpleCredentials;
+import javax.security.auth.login.LoginException;
+
+import org.apache.jackrabbit.oak.spi.security.authentication.AbstractLoginModule;
+import org.apache.jackrabbit.oak.spi.security.authentication.PreAuthenticatedLogin;
+import org.apache.sling.auth.form.impl.FormAuthenticationHandler;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+final class FormLoginModule extends AbstractLoginModule {
+    private static final Logger log = LoggerFactory.getLogger(FormLoginModule.class);
+
+    /**
+     * The set of supported credentials. required by the {@link org.apache.jackrabbit.oak.spi.security.authentication.AbstractLoginModule}
+     */
+    private static final Set<Class> SUPPORTED_CREDENTIALS = Collections.<Class>singleton(FormCredentials.class);
+    private static final char[] EMPTY_PWD = new char[0];
+
+    /**
+     * Extracted userId during login call.
+     */
+    private String userId;
+
+    @Override
+    protected Set<Class> getSupportedCredentials() {
+        return SUPPORTED_CREDENTIALS;
+    }
+
+    /**
+     * The {@link org.apache.sling.auth.form.impl.FormAuthenticationHandler} used to validate the credentials
+     * and its contents.
+     */
+    private final FormAuthenticationHandler authHandler;
+
+    FormLoginModule(FormAuthenticationHandler authHandler) {
+        this.authHandler = authHandler;
+    }
+
+    @SuppressWarnings("unchecked")
+    public boolean login() throws LoginException {
+        Credentials credentials = getCredentials();
+        if (credentials instanceof FormCredentials) {
+            FormCredentials cred = (FormCredentials) credentials;
+            userId = cred.getUserId();
+
+            if (!authHandler.isValid(cred)){
+                log.debug("Invalid credentials");
+                return false;
+            }
+
+            if (userId == null) {
+                log.debug("Could not extract userId/credentials");
+            } else {
+                // we just set the login name and rely on the following login modules to populate the subject
+                sharedState.put(SHARED_KEY_PRE_AUTH_LOGIN, new PreAuthenticatedLogin(userId));
+                sharedState.put(SHARED_KEY_CREDENTIALS, new SimpleCredentials(userId, EMPTY_PWD));
+                sharedState.put(SHARED_KEY_LOGIN_NAME, userId);
+                log.debug("login succeeded with trusted user: {}", userId);
+            }
+        }
+        return false;
+    }
+
+    public boolean commit() throws LoginException {
+        if (userId == null) {
+            // login attempt in this login module was not successful
+            clearState();
+        }
+        return false;
+    }
+
+    @Override
+    protected void clearState() {
+        userId = null;
+        super.clearState();
+    }
+}
diff --git a/src/main/java/org/apache/sling/auth/form/impl/jaas/JaasHelper.java b/src/main/java/org/apache/sling/auth/form/impl/jaas/JaasHelper.java
new file mode 100644
index 0000000..bb5a1b5
--- /dev/null
+++ b/src/main/java/org/apache/sling/auth/form/impl/jaas/JaasHelper.java
@@ -0,0 +1,128 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.sling.auth.form.impl.jaas;
+
+import java.util.Dictionary;
+
+import javax.security.auth.spi.LoginModule;
+
+import org.apache.felix.jaas.LoginModuleFactory;
+import org.apache.sling.auth.form.impl.FormAuthenticationHandler;
+import org.osgi.framework.BundleContext;
+import org.osgi.framework.Constants;
+import org.osgi.framework.ServiceRegistration;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class JaasHelper {
+
+    private static final Logger log = LoggerFactory.getLogger(JaasHelper.class);
+
+    private final FormAuthenticationHandler authHandler;
+
+    /**
+     * login module service registration
+     */
+    private final ServiceRegistration factoryRegistration;
+
+    /**
+     * Opens/Initializes the helper and registers the login module factory (LMF) service if possible.
+     *
+     * @param ctx        the bundle context
+     * @param properties properties that contain the jaas related LMF service properties.
+     */
+    public JaasHelper(FormAuthenticationHandler authHandler, BundleContext ctx, Dictionary properties) {
+        this.authHandler = authHandler;
+        // we dynamically register the LoginModuleFactory for the case we detect a login module.
+        if (hasSSOLoginModule(ctx)) {
+            factoryRegistration = registerLoginModuleFactory(ctx, properties);
+        } else {
+            factoryRegistration = null;
+        }
+    }
+
+    /**
+     * Checks if JAAS support is enabled and the SSO login module is present.
+     *
+     * @return {@code true} if JAAS support is enabled.
+     */
+    public boolean enabled() {
+        return factoryRegistration != null;
+    }
+
+
+    /**
+     * Closes this helper and unregisters the login module factory if needed.
+     */
+    public void close() {
+        if (factoryRegistration != null) {
+            factoryRegistration.unregister();
+        }
+    }
+
+    private ServiceRegistration registerLoginModuleFactory(BundleContext ctx, Dictionary properties) {
+        ServiceRegistration reg = null;
+        try {
+            java.util.Properties props = new java.util.Properties();
+            final String desc = "LoginModule Support for FormAuthenticationHandler";
+            props.put(Constants.SERVICE_DESCRIPTION, desc);
+            props.put(Constants.SERVICE_VENDOR, ctx.getBundle().getHeaders().get(Constants.BUNDLE_VENDOR));
+
+            props.put(LoginModuleFactory.JAAS_RANKING, properties.get(LoginModuleFactory.JAAS_RANKING));
+            props.put(LoginModuleFactory.JAAS_CONTROL_FLAG, properties.get(LoginModuleFactory.JAAS_CONTROL_FLAG));
+            props.put(LoginModuleFactory.JAAS_REALM_NAME, properties.get(LoginModuleFactory.JAAS_REALM_NAME));
+            reg = ctx.registerService(LoginModuleFactory.class.getName(),
+                    new LoginModuleFactory() {
+                        public LoginModule createLoginModule() {
+                            return new FormLoginModule(authHandler);
+                        }
+
+                        @Override
+                        public String toString() {
+                            return desc + " (" +FormLoginModule.class.getName()+")";
+                        }
+                    },
+                    props
+            );
+            log.info("Registered FormLoginModuleFactory");
+        } catch (Throwable e) {
+            log.error("unable to create an register the SSO login module factory", e);
+        }
+        return reg;
+    }
+
+    /**
+     * Checks if the {@link org.apache.sling.auth.form.impl.jaas.FormLoginModule} is available. This would not be the case
+     * in an non-oak setup. Note this only checks if the login module can be loaded, not if it is actually enabled
+     * in the jaas config.
+     *
+     * @return {@code true} if the SSOLoginModule is available.
+     */
+    private static boolean hasSSOLoginModule(BundleContext ctx) {
+        try {
+            ctx.getBundle().loadClass("org.apache.sling.auth.form.impl.jaas.FormLoginModule");
+            log.debug("FormLoginModule available.");
+            return true;
+        } catch (Throwable e) {
+            log.debug("no FormLoginModule available.", e);
+        }
+        return false;
+    }
+}
diff --git a/src/main/resources/OSGI-INF/metatype/metatype.properties b/src/main/resources/OSGI-INF/metatype/metatype.properties
index 2d92666..7070cdb 100644
--- a/src/main/resources/OSGI-INF/metatype/metatype.properties
+++ b/src/main/resources/OSGI-INF/metatype/metatype.properties
@@ -91,4 +91,19 @@
 form.default.cookie.domain.description = The domain on which authentication cookies will \
  be set, unless overridden in the AuthenticationInfo object. The default is null \
  which means to set the cookie on the request domain.
- 
\ No newline at end of file
+
+jaas.controlFlag.name = JAAS Control Flag
+jaas.controlFlag.description = Property name specifying whether or not a LoginModule is REQUIRED, REQUISITE, SUFFICIENT \
+  or OPTIONAL. Refer to the JAAS configuration documentation for more details around the meaning of these flags. \
+  Jackrabbit Oak only.
+
+jaas.realmName.name = JAAS Realm
+jaas.realmName.description = Property name specifying the realm name (or application name) against which the LoginModule \
+  is be registered. If no realm name is provided then LoginModule is registered with a default realm as configured in \
+  the Felix JAAS configuration. \
+  Jackrabbit Oak only.
+
+jaas.ranking.name = JAAS Ranking
+jaas.ranking.description = Property name specifying the ranking (i.e. sort order) of the configured login module \
+  entries. The entries are sorted in a descending order (i.e. higher value ranked configurations come first). \
+  Jackrabbit Oak only.