SecurityCallback

Used in relation to events occurring within the scope of a connection. The SecurityCallBack is used when information is required for authentication.

If this callback has a lifetime that is less than that of the object it is associated with, the client API must be informed of its pending destruction to prevent it from attempting to invoke methods on the callback after its destruction. Inform the client API by calling invalidateCallback() on the respective associated objects. If you are not sure of the scope, make these calls explicitly to prevent unexpected errors within the client.

Ensure you keep the DefaultSecurityCallback as a global variable. The callback used for security has to exist for the lifetime of the connection.

You need to create the callback object on the heap and treat it the same way the SessionCallback is treated in respect to the session (but for the connection instead).