The Principal returned by the request is a SimplePrincipal, it doesn't have the getSubject method :( I discovered that the subject is in the JNDI tree: ctx.lookup("java:/comp/env/security/subject"); another interesting thing is that if I create the subject myself by using the LoginContext , no subject is placed in the jndi context. I'm not very confident with the jndi solution yet, but it looks like it works. I will take a look in the valves of tomcat too waren! Thanks View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3957605#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...