Thank you Tim,
I would definitely file a security issue on this problem. It seems like a good way for me to start contributing to the GlassFish project (by complaining) :-).
The version of GlassFish I'm using is 9.1ur2. Following your link to Issue 2310, it looks like the re-try issue has been addressed in 9.1ur1.
It is suggested in Issue 2310 that the System Property "NumberOfLoginRetries" should be set to specify the number times allowed for login re-tries. I proceeded to set that system property (under Configuration -> System Properties in the admin console), restarted the server, run my application client again. My application client quits after one failed login attempt. I wonder if anyone has tried this and can point out if I'm missing anything.
Thanks.
[Message sent by forum member 'bentsou' (bentsou)]
http://forums.java.net/jive/thread.jspa?messageID=275772