I have tried your code in JBoss portal 2.7.2 and i got an error :
java.lang.IllegalArgumentException: unknown handler key
at javax.security.jacc.PolicyContext.getContext(PolicyContext.java:280)
Well JBoss 2.7.2 implements JSR 286 so i should be able to use the shared-session-attribute but it doesn't work better...