Webrev at: http://cr.openjdk.java.net/~mchung/jdk9/webrevs/8173024/webrev.00/
sun.security.util.ResourcesMgr::getString(String s, String altBundleName) is one existing mechanism to get the localized string from AuthResources and have sun.security.util.AuthResources resource bundle encapsulated in java.base. jdk.security.auth loads “sun.security.util.AuthResources” resource bundle in some place and uses ResourcesMgr::getString as well. This patch replaces direct loading of AuthResources resource bundle from jdk.security.auth so that jdk.security.auth does not need to access the resource bundle directly. I ran all core tests. Mandy