"bdaw" wrote : Maybe it would make sense to let use those information in API more directly? Something like: | - associateGroups(GroupType parentType, String, parentName, GroupType childType, String childName) | exactly. the default case should be a one-to-one mapping between the api-ID and the phisical identityStore-ID. only if the user wants to bind to some exotic identity store, then a mapping between the API-ID strings and the identity store IDs might be necessary. the API/SPI architecture would still allow that. i would even make the groupTypes plain strings in the api. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4209504#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...