Ok, in talking to Anil the issue is what Darran wants a more restrictive implementation of SimplePrincipal.equals to only consider equality with other SimplePrincipals. That is valid if you are going to mix Principal implementations, but this should not be happening for a given security domain. My question is why is it? Is it because a single cache is being used by multiple security domains? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4077867#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...