Hi Boleslaw, I'm interested in the "identity responsibilities decisions" you mentioned above from the view of the database usage. Our customer needs role assignments to groups of users in order to easily authorize a new user with a set of portal funtionality. "Provisioning" shall take place as "pull service" at the portal side, which periodically requests the entitlement changes and updates the portals data. Therefore the portals database can/shall be used (in order to have just one server/service). Managing role assignments to groups wthin the portal is a "nice to have" feature, but xml-based mass-changes is required. I would like to provide these features on the basis of your design decisions. Burkhard cf: http://jboss.org/index.html?module=bb&op=viewtopic&t=91902 View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3981027#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...