diff --git a/appserver/security/appclient.security/pom.xml b/appserver/security/appclient.security/pom.xml
index 7210550..f2e7dee 100644
--- a/appserver/security/appclient.security/pom.xml
+++ b/appserver/security/appclient.security/pom.xml
@@ -88,6 +88,10 @@
             <artifactId>orb-connector</artifactId>
             <version>${project.version}</version>
         </dependency>
+        <dependency>
+            <groupId>jakarta.authorization</groupId>
+            <artifactId>jakarta.authorization-api</artifactId>
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/appserver/security/appclient.security/src/main/java/com/sun/enterprise/security/appclient/AppClientSecurityInfoImpl.java b/appserver/security/appclient.security/src/main/java/com/sun/enterprise/security/appclient/AppClientSecurityInfoImpl.java
index a19ff84..976a070 100644
--- a/appserver/security/appclient.security/src/main/java/com/sun/enterprise/security/appclient/AppClientSecurityInfoImpl.java
+++ b/appserver/security/appclient.security/src/main/java/com/sun/enterprise/security/appclient/AppClientSecurityInfoImpl.java
@@ -35,7 +35,7 @@
 import javax.inject.Inject;
 import javax.security.auth.Subject;
 import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.message.config.AuthConfigFactory;
+import jakarta.security.auth.message.config.AuthConfigFactory;
 import org.glassfish.appclient.client.acc.config.MessageSecurityConfig;
 import org.glassfish.appclient.client.acc.config.Security;
 import org.glassfish.appclient.client.acc.config.Ssl;
diff --git a/appserver/security/appclient.security/src/main/java/com/sun/enterprise/security/appclient/ConfigXMLParser.java b/appserver/security/appclient.security/src/main/java/com/sun/enterprise/security/appclient/ConfigXMLParser.java
index 9272133..1c14b81 100644
--- a/appserver/security/appclient.security/src/main/java/com/sun/enterprise/security/appclient/ConfigXMLParser.java
+++ b/appserver/security/appclient.security/src/main/java/com/sun/enterprise/security/appclient/ConfigXMLParser.java
@@ -36,7 +36,7 @@
 import com.sun.enterprise.security.jmac.AuthMessagePolicy;
 import java.io.FileInputStream;
 import java.io.InputStream;
-import javax.security.auth.message.MessagePolicy;
+import jakarta.security.auth.message.MessagePolicy;
 import jakarta.xml.bind.JAXBContext;
 import jakarta.xml.bind.Unmarshaller;
 import org.glassfish.internal.api.Globals;
diff --git a/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SharedState.java b/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SharedState.java
index dac0614..092b786 100644
--- a/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SharedState.java
+++ b/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SharedState.java
@@ -23,8 +23,8 @@
 import java.util.concurrent.locks.ReentrantReadWriteLock;
 import java.util.logging.Level;
 import java.util.logging.Logger;
-import javax.security.jacc.PolicyContext;
-import javax.security.jacc.PolicyContextException;
+import jakarta.security.jacc.PolicyContext;
+import jakarta.security.jacc.PolicyContextException;
 
 /**
  * 
@@ -137,11 +137,11 @@
      * and idempotent. 
      * @param id
      * @param otherId
-     * @throws javax.security.jacc.PolicyContextException If otherID 
+     * @throws jakarta.security.jacc.PolicyContextException If otherID 
      * equals receiverID. no relationship is formed.
      */
     static void link(String id, String otherId)
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
 
         wLock.lock();
         try {
diff --git a/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SimplePolicyConfiguration.java b/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SimplePolicyConfiguration.java
index 3686aba..f35fdd5 100644
--- a/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SimplePolicyConfiguration.java
+++ b/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SimplePolicyConfiguration.java
@@ -32,14 +32,14 @@
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import javax.management.MBeanPermission;
-import javax.security.jacc.EJBRoleRefPermission;
-import javax.security.jacc.PolicyConfiguration;
-import javax.security.jacc.PolicyContext;
-import javax.security.jacc.PolicyContextException;
-import javax.security.jacc.PolicyContextHandler;
-import javax.security.jacc.WebResourcePermission;
-import javax.security.jacc.WebRoleRefPermission;
-import javax.security.jacc.WebUserDataPermission;
+import jakarta.security.jacc.EJBRoleRefPermission;
+import jakarta.security.jacc.PolicyConfiguration;
+import jakarta.security.jacc.PolicyContext;
+import jakarta.security.jacc.PolicyContextException;
+import jakarta.security.jacc.PolicyContextHandler;
+import jakarta.security.jacc.WebResourcePermission;
+import jakarta.security.jacc.WebRoleRefPermission;
+import jakarta.security.jacc.WebUserDataPermission;
 
 /**
  *
@@ -138,14 +138,14 @@
      * if called by an AccessControlContext that has not been
      * granted the "setPolicy" SecurityPermission.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the getContextID method signature. The exception thrown
      * by the implementation class will be encapsulated (during construction)
      * in the thrown PolicyContextException.
      */
     public String getContextID()
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         return id;
     }
 
@@ -173,14 +173,14 @@
      * PolicyConfiguration Object is "deleted" or "inService" when this
      * method is called.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the addToRole method signature. The exception thrown
      * by the implementation class will be encapsulated (during construction)
      * in the thrown PolicyContextException.
      */
     public void addToRole(String roleName, PermissionCollection permissions)
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         checkSetPolicyPermission();
         pcwLock.lock();
         try {
@@ -219,14 +219,14 @@
      * PolicyConfiguration Object is "deleted" or "inService" when this
      * method is called.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the addToRole method signature. The exception thrown
      * by the implementation class will be encapsulated (during construction)
      * in the thrown PolicyContextException.
      */
     public void addToRole(String roleName, Permission permission)
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         checkSetPolicyPermission();
         pcwLock.lock();
         try {
@@ -257,7 +257,7 @@
      * PolicyConfiguration Object is "deleted" or "inService" when this
      * method is called.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the addToUncheckedPolicy method signature.
      * The exception thrown
@@ -265,7 +265,7 @@
      * in the thrown PolicyContextException.
      */
     public void addToUncheckedPolicy(PermissionCollection permissions)
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         checkSetPolicyPermission();
         pcwLock.lock();
         try {
@@ -300,7 +300,7 @@
      * PolicyConfiguration Object is "deleted" or "inService" when this
      * method is called.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the addToUncheckedPolicy method signature.
      * The exception thrown
@@ -308,7 +308,7 @@
      * in the thrown PolicyContextException.
      */
     public void addToUncheckedPolicy(Permission permission)
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         checkSetPolicyPermission();
         pcwLock.lock();
         try {
@@ -339,7 +339,7 @@
      * PolicyConfiguration Object is "deleted" or "inService" when this
      * method is called.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the addToExcludedPolicy method signature.
      * The exception thrown
@@ -347,7 +347,7 @@
      * in the thrown PolicyContextException.
      */
     public void addToExcludedPolicy(PermissionCollection permissions)
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         checkSetPolicyPermission();
         pcwLock.lock();
         try {
@@ -382,7 +382,7 @@
      * PolicyConfiguration Object is "deleted" or "inService" when this
      * method is called.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the addToExcludedPolicy method signature.
      * The exception thrown
@@ -390,7 +390,7 @@
      * in the thrown PolicyContextException.
      */
     public void addToExcludedPolicy(Permission permission)
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         checkSetPolicyPermission();
         pcwLock.lock();
         try {
@@ -421,14 +421,14 @@
      * PolicyConfiguration Object is "deleted" or "inService" when this
      * method is called.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the removeRole method signature. The exception thrown
      * by the implementation class will be encapsulated (during construction)
      * in the thrown PolicyContextException.
      */
     public void removeRole(String roleName)
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         checkSetPolicyPermission();
         pcwLock.lock();
         try {
@@ -463,7 +463,7 @@
      * PolicyConfiguration Object is "deleted" or "inService" when this
      * method is called.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the removeUncheckedPolicy method signature.
      * The exception thrown
@@ -471,7 +471,7 @@
      * in the thrown PolicyContextException.
      */
     public void removeUncheckedPolicy()
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         checkSetPolicyPermission();
         pcwLock.lock();
         try {
@@ -497,7 +497,7 @@
      * PolicyConfiguration Object is "deleted" or "inService" when this
      * method is called.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the removeExcludedPolicy method signature.
      * The exception thrown
@@ -505,7 +505,7 @@
      * in the thrown PolicyContextException.
      */
     public void removeExcludedPolicy()
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         checkSetPolicyPermission();
         pcwLock.lock();
         try {
@@ -551,7 +551,7 @@
      * if called with an argument PolicyConfiguration whose Policy context
      * is equivalent to that of this PolicyConfiguration.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the linkConfiguration method signature. The exception
      * thrown
@@ -559,7 +559,7 @@
      * in the thrown PolicyContextException.
      */
     public void linkConfiguration(PolicyConfiguration link)
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
 
         checkSetPolicyPermission();
         pcrLock.lock();
@@ -589,13 +589,13 @@
      * if called by an AccessControlContext that has not been
      * granted the "setPolicy" SecurityPermission.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the delete method signature. The exception thrown
      * by the implementation class will be encapsulated (during construction)
      * in the thrown PolicyContextException.
      */
-    public void delete() throws javax.security.jacc.PolicyContextException {
+    public void delete() throws jakarta.security.jacc.PolicyContextException {
 
         checkSetPolicyPermission();
         SharedState.removeLinks(id);
@@ -639,14 +639,14 @@
      * PolicyConfiguration Object is "deleted" when this
      * method is called.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the commit method signature. The exception thrown
      * by the implementation class will be encapsulated (during construction)
      * in the thrown PolicyContextException.
      */
     public void commit()
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         checkSetPolicyPermission();
         boolean initRoles = false;
         pcwLock.lock();
@@ -683,14 +683,14 @@
      * if called by an AccessControlContext that has not been
      * granted the "setPolicy" SecurityPermission.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the inService method signature. The exception thrown
      * by the implementation class will be encapsulated (during construction)
      * in the thrown PolicyContextException.
      */
     public boolean inService()
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         pcrLock.lock();
         try {
             return stateIs(INSERVICE_STATE);
@@ -719,7 +719,7 @@
     }
 
     protected static boolean inService(String pcid)
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         SimplePolicyConfiguration pc = SharedState.lookupConfig(pcid);
         if (pc == null) {
             return false;
@@ -798,7 +798,7 @@
 
     /**
      * Adds the principal-2-role mapping to the roles in the roleTable
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      */
     private void commitRoleMapping() throws PolicyContextException {
         JACCRoleMapper roleMapper = null;
@@ -938,7 +938,7 @@
      * @param d 
      * @param p
      * @return integer -1 if excluded, 0 if not implied, 1 if implied.
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      */
     private int doImplies(ProtectionDomain d, Permission p)
             throws PolicyContextException {
diff --git a/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SimplePolicyConfigurationFactory.java b/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SimplePolicyConfigurationFactory.java
index 47b30d1..5274db0 100644
--- a/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SimplePolicyConfigurationFactory.java
+++ b/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SimplePolicyConfigurationFactory.java
@@ -16,8 +16,8 @@
 
 package com.sun.enterprise.security.jacc.provider;
 
-import javax.security.jacc.PolicyConfiguration;
-import javax.security.jacc.PolicyConfigurationFactory;
+import jakarta.security.jacc.PolicyConfiguration;
+import jakarta.security.jacc.PolicyConfigurationFactory;
 
 /**
  * Abstract factory and finder class for obtaining
@@ -30,8 +30,8 @@
  * may be used to create an operational instance of the factory implementation
  * class.
  *
- * @see javax.security.jacc.PolicyConfiguration
- * @see javax.security.jacc.PolicyContextException
+ * @see jakarta.security.jacc.PolicyConfiguration
+ * @see jakarta.security.jacc.PolicyContextException
  *
  * @author monzillo
  */
@@ -85,7 +85,7 @@
      * when called by an AccessControlContext that has not been
      * granted the "setPolicy" SecurityPermission.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the getPolicyConfiguration method signature.
      * The exception thrown
@@ -93,7 +93,7 @@
      * in the thrown PolicyContextException.
      */
     public PolicyConfiguration getPolicyConfiguration(String contextID, boolean remove)
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         return SimplePolicyConfiguration.getPolicyConfig(contextID, remove);
     }
 
@@ -111,14 +111,14 @@
      * when called by an AccessControlContext that has not been
      * granted the "setPolicy" SecurityPermission.
      *
-     * @throws javax.security.jacc.PolicyContextException
+     * @throws jakarta.security.jacc.PolicyContextException
      * if the implementation throws a checked exception that has not been
      * accounted for by the inService method signature. The exception thrown
      * by the implementation class will be encapsulated (during construction)
      * in the thrown PolicyContextException.
      */
     public boolean inService(String contextID)
-            throws javax.security.jacc.PolicyContextException {
+            throws jakarta.security.jacc.PolicyContextException {
         return SimplePolicyConfiguration.inService(contextID);
     }
 }
diff --git a/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SimplePolicyProvider.java b/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SimplePolicyProvider.java
index 39806dc..331be77 100644
--- a/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SimplePolicyProvider.java
+++ b/appserver/security/inmemory.jacc.provider/src/main/java/com/sun/enterprise/security/jacc/provider/SimplePolicyProvider.java
@@ -22,8 +22,8 @@
 import java.security.Policy;
 import java.security.ProtectionDomain;
 import java.util.logging.Level;
-import javax.security.jacc.PolicyContext;
-import javax.security.jacc.PolicyContextException;
+import jakarta.security.jacc.PolicyContext;
+import jakarta.security.jacc.PolicyContextException;
 
 /**
  *
diff --git a/appserver/security/jaspic-provider-framework/pom.xml b/appserver/security/jaspic-provider-framework/pom.xml
index ba7a465..60ecd84 100644
--- a/appserver/security/jaspic-provider-framework/pom.xml
+++ b/appserver/security/jaspic-provider-framework/pom.xml
@@ -41,5 +41,9 @@
             <groupId>jakarta.security.auth.message</groupId>
             <artifactId>jakarta.security.auth.message-api</artifactId>
         </dependency>
+        <dependency>
+            <groupId>jakarta.authorization</groupId>
+            <artifactId>jakarta.authorization-api</artifactId>
+        </dependency>
     </dependencies>
 </project>
diff --git a/appserver/security/jaspic-provider-framework/src/main/java/com/sun/jaspic/config/servlet/JAASServletAuthConfigProvider.java b/appserver/security/jaspic-provider-framework/src/main/java/com/sun/jaspic/config/servlet/JAASServletAuthConfigProvider.java
index 8c64d0e..1cc12e1 100755
--- a/appserver/security/jaspic-provider-framework/src/main/java/com/sun/jaspic/config/servlet/JAASServletAuthConfigProvider.java
+++ b/appserver/security/jaspic-provider-framework/src/main/java/com/sun/jaspic/config/servlet/JAASServletAuthConfigProvider.java
@@ -35,7 +35,7 @@
 public class JAASServletAuthConfigProvider extends JAASAuthConfigProvider {
 
     private static final String HTTP_SERVLET_LAYER = "HttpServlet";
-    private static final String MANDATORY_KEY = "javax.security.auth.message.MessagePolicy.isMandatory";
+    private static final String MANDATORY_KEY = "jakarta.security.auth.message.MessagePolicy.isMandatory";
     private static final String MANDATORY_AUTH_CONTEXT_ID = "mandatory";
     private static final String OPTIONAL_AUTH_CONTEXT_ID = "optional";
     private static final Class[] moduleTypes = new Class[] {ServerAuthModule.class};
diff --git a/appserver/security/webintegration/src/main/java/com/sun/web/security/RealmAdapter.java b/appserver/security/webintegration/src/main/java/com/sun/web/security/RealmAdapter.java
index 2b4e493..bea0e7d 100644
--- a/appserver/security/webintegration/src/main/java/com/sun/web/security/RealmAdapter.java
+++ b/appserver/security/webintegration/src/main/java/com/sun/web/security/RealmAdapter.java
@@ -130,8 +130,8 @@
     public static final String SECURITY_CONTEXT = "SecurityContext";
     public static final String BASIC = "BASIC";
     public static final String FORM = "FORM";
-    private static final String SERVER_AUTH_CONTEXT = "__javax.security.auth.message.ServerAuthContext";
-    private static final String MESSAGE_INFO = "__javax.security.auth.message.MessageInfo";
+    private static final String SERVER_AUTH_CONTEXT = "__jakarta.security.auth.message.ServerAuthContext";
+    private static final String MESSAGE_INFO = "__jakarta.security.auth.message.MessageInfo";
     private static final WebSecurityDeployerProbeProvider websecurityProbeProvider = new WebSecurityDeployerProbeProvider();
 
     // name of system property that can be used to define 
diff --git a/appserver/security/webservices.security/pom.xml b/appserver/security/webservices.security/pom.xml
index e68a8e2..5f1195f 100644
--- a/appserver/security/webservices.security/pom.xml
+++ b/appserver/security/webservices.security/pom.xml
@@ -139,5 +139,9 @@
             <artifactId>logging-annotation-processor</artifactId>
             <optional>true</optional>
         </dependency>
+        <dependency>
+            <groupId>jakarta.authorization</groupId>
+            <artifactId>jakarta.authorization-api</artifactId>
+        </dependency>
     </dependencies>
 </project>
diff --git a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/jmac/provider/PacketMessageInfo.java b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/jmac/provider/PacketMessageInfo.java
index 03f23d4..cbdb7ff 100644
--- a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/jmac/provider/PacketMessageInfo.java
+++ b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/jmac/provider/PacketMessageInfo.java
@@ -16,7 +16,7 @@
 
 package com.sun.enterprise.security.jmac.provider;
 
-import javax.security.auth.message.MessageInfo;
+import jakarta.security.auth.message.MessageInfo;
 import com.sun.xml.ws.api.message.Packet;
 
 /**
diff --git a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/jmac/provider/config/PipeHelper.java b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/jmac/provider/config/PipeHelper.java
index 0d071d8..8ddb254 100644
--- a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/jmac/provider/config/PipeHelper.java
+++ b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/jmac/provider/config/PipeHelper.java
@@ -21,13 +21,13 @@
 import java.util.Map;
 import javax.security.auth.Subject;
 import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.message.AuthException;
-import javax.security.auth.message.AuthStatus;
-import javax.security.auth.message.MessageInfo;
-import javax.security.auth.message.config.ClientAuthConfig;
-import javax.security.auth.message.config.ClientAuthContext;
-import javax.security.auth.message.config.ServerAuthConfig;
-import javax.security.auth.message.config.ServerAuthContext;
+import jakarta.security.auth.message.AuthException;
+import jakarta.security.auth.message.AuthStatus;
+import jakarta.security.auth.message.MessageInfo;
+import jakarta.security.auth.message.config.ClientAuthConfig;
+import jakarta.security.auth.message.config.ClientAuthContext;
+import jakarta.security.auth.message.config.ServerAuthConfig;
+import jakarta.security.auth.message.config.ServerAuthContext;
 import jakarta.xml.ws.WebServiceException;
 //import com.sun.ejb.Container;
 //import com.sun.ejb.Invocation;
diff --git a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/ClientPipeCloser.java b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/ClientPipeCloser.java
index 6532d89..ba0a2d9 100644
--- a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/ClientPipeCloser.java
+++ b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/ClientPipeCloser.java
@@ -21,7 +21,7 @@
 import com.sun.enterprise.security.jmac.config.ConfigHelper.AuthConfigRegistrationWrapper;
 import java.util.Map;
 import java.util.WeakHashMap;
-import javax.security.auth.message.config.RegistrationListener;
+import jakarta.security.auth.message.config.RegistrationListener;
 
 public class ClientPipeCloser {
     
diff --git a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/ClientSecurityPipe.java b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/ClientSecurityPipe.java
index fc4d076..fbf5c1b 100644
--- a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/ClientSecurityPipe.java
+++ b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/ClientSecurityPipe.java
@@ -23,8 +23,8 @@
 import java.util.Map;
 
 import javax.security.auth.Subject;
-import javax.security.auth.message.config.*;
-import javax.security.auth.message.AuthStatus;
+import jakarta.security.auth.message.config.*;
+import jakarta.security.auth.message.AuthStatus;
 import jakarta.xml.ws.WebServiceException;
 
 import com.sun.enterprise.security.jmac.provider.PacketMessageInfo;
diff --git a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/ClientSecurityTube.java b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/ClientSecurityTube.java
index 2b792eb..30c93dc 100644
--- a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/ClientSecurityTube.java
+++ b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/ClientSecurityTube.java
@@ -25,8 +25,8 @@
 import java.util.Map;
 
 import javax.security.auth.Subject;
-import javax.security.auth.message.config.*;
-import javax.security.auth.message.AuthStatus;
+import jakarta.security.auth.message.config.*;
+import jakarta.security.auth.message.AuthStatus;
 import jakarta.xml.ws.WebServiceException;
 
 import com.sun.enterprise.security.jmac.provider.PacketMessageInfo;
diff --git a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/CommonServerSecurityPipe.java b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/CommonServerSecurityPipe.java
index 9c72abc..848549d 100644
--- a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/CommonServerSecurityPipe.java
+++ b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/CommonServerSecurityPipe.java
@@ -23,9 +23,9 @@
 import java.security.PrivilegedExceptionAction;
 import java.security.PrivilegedActionException;
 import javax.security.auth.Subject;
-import javax.security.auth.message.config.*;
-import javax.security.auth.message.AuthException;
-import javax.security.auth.message.AuthStatus;
+import jakarta.security.auth.message.config.*;
+import jakarta.security.auth.message.AuthException;
+import jakarta.security.auth.message.AuthStatus;
 
 import jakarta.xml.ws.WebServiceException;
 
diff --git a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/CommonServerSecurityTube.java b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/CommonServerSecurityTube.java
index 5b5a7bc..b43b0aa 100644
--- a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/CommonServerSecurityTube.java
+++ b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/CommonServerSecurityTube.java
@@ -25,9 +25,9 @@
 import java.security.PrivilegedExceptionAction;
 import java.security.PrivilegedActionException;
 import javax.security.auth.Subject;
-import javax.security.auth.message.config.*;
-import javax.security.auth.message.AuthException;
-import javax.security.auth.message.AuthStatus;
+import jakarta.security.auth.message.config.*;
+import jakarta.security.auth.message.AuthException;
+import jakarta.security.auth.message.AuthStatus;
 
 import jakarta.xml.ws.WebServiceException;
 
diff --git a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/SecurityServiceImpl.java b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/SecurityServiceImpl.java
index 42beb16..90a712f 100644
--- a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/SecurityServiceImpl.java
+++ b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/SecurityServiceImpl.java
@@ -49,7 +49,7 @@
 import java.util.ArrayList;
 import java.util.List;
 import javax.inject.Inject;
-import javax.security.jacc.PolicyContext;
+import jakarta.security.jacc.PolicyContext;
 import jakarta.xml.soap.SOAPMessage;
 
 /**
diff --git a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/WebServicesDelegateImpl.java b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/WebServicesDelegateImpl.java
index a11c67d..204dd1d 100644
--- a/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/WebServicesDelegateImpl.java
+++ b/appserver/security/webservices.security/src/main/java/com/sun/enterprise/security/webservices/WebServicesDelegateImpl.java
@@ -32,7 +32,7 @@
 import java.util.Map;
 import java.util.logging.Level;
 import java.util.logging.Logger;
-import javax.security.auth.message.MessageInfo;
+import jakarta.security.auth.message.MessageInfo;
 import javax.xml.namespace.QName;
 import jakarta.xml.soap.MimeHeaders;
 import jakarta.xml.soap.Name;