I implemented a custom Principal to hold the additional user information (and a custom LoginModule to populate it in the Group array); that does get the job done, which is good enough, for now. I'll keep an eye on your blog, Andrew; I'm still thinking about an invocation framework that is "client agnostic," so I'll be interested to see your thoughts on that. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4135823#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...