Which is expected. The KerberosPrincipal is more restrictive and should not view the jboss implementation as equivalent. I don't see what your asking for as you started by saying we go too far. I'm saying we go the minimal distance for a meaningful Principal equals implementation. The only other Principal implementations for which mutual equality exists are those for which the name is sufficient. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4077525#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...