What you really need is a federation gateway or such that can negotiate identity (plus attributes) across trust domains. Our WS-T STS implementation is mainly for that - issuing SAML assertions (that can of course include attributes). Now it is upto E2 to decide what roles the incoming user is. If FreeBSD has a Java VM (it should), then any of the Java solutions should work. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4237531#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...