[jboss-jira] [JBoss JIRA] Updated: (JBAS-7698) Principal information used to check web security constraints should be read from Subject

Principal information used to check web security constraints should be read from Subject ---------------------------------------------------------------------------------------- Key: JBAS-7698 URL: https://jira.jboss.org/jira/browse/JBAS-7698 Project: JBoss Application Server Issue Type: Feature Request Security Level: Public(Everyone can see) Components: Security Affects Versions: JBossAS-5.1.0.GA Environment: RHEL, JDK6u12, JBossAS 5.0.1 Reporter: eugene75 Assignee: Anil Saldhana Priority: Minor The JBossGenericPrincipal instance constructed and cached by JBossWebRealm.authenticate() creates a copy of Subject caller principal, roles, password. Therefore any modifications to the subject during the user's session and not propagated to the JBossGenericPrincipal. It would be preferable if the data returned by JBossGenericPrincipal came directly from the Subject object itself.