In our JDK modularity work then we currently put Kerberos, SASL and the JDK-specific API to JAAS in the same module to avoid circular dependencies. We need to clean this up and this requires dealing with these dependencies:

sun.security.jgss.GSSUtil -> com.sun.security.auth.callbackTextCallbackHandler
com.sun.security.auth.module -> javax.security.auth.kerberos

It is trivial for GSSUtil to use an alternative console based CallbackHandler and that will eliminate the circular dependency.