Re: [jboss-as7-dev] On security context and propagation

So for entry to the server making use of HTTP and SASL based authentication backed by an IDM instead of JAAS and then converting the loaded identity into a Subject does sound good. One point to keep in mind that is different from the JAAS population of Subjects however is that the IDM approach is not currently expecting to load roles pro-actively for an identity, instead it is expecting to respond to isCallerInRole type checks as and when role checks are required. Applications however do have a finite set of roles used so there are options here.