Can you modify the mandatory profile to include the java config? That way you don't need to put it in the login script, which may not actually be completing for some users.