1: Correct, and besides that there are no clashes between user/role/group values. 2: Correct but we kind of use the string as the primary key (see 1) We indeed have adapted the identity module so it uses an additional query. We also want this since it makes the group membership dynamic. Before extending the identity module in jBPM (you can do it yourself atm) we should wait what 4.0 will bring. Big chance it will be redesigned and intergrate e.g. with the portal which in turn can use opensso so... View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4095568#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...