I'm using the new user storage provider stuff to federate users from an existing database. It's mostly working, but I'm having trouble with role updates propogating. My UserAdapter extends AbstractUserAdapterFederatedStorage. If I do not override grantRole(), deleteRoleMapping(), and getFederatedRoleMappings(), KC's view of the users roles is only set the first time the user is loaded. Neither adding nor removing roles changes the list. If I *do* override those methods, then at least adding a role updates the list. Removing them still does not. I'm using UserAdapter#grantRole() to add the roles I've tried all of UserAdapter#deleteRoleMapping() UserAdapter#getRealmRoleMappings()#remove() UserAdapter#getRoleMappings()#remove() to remove roles to no avail. What am I missing? KC 2.1.1.Final -- Harold Campbell <hcamp(a)muerte.net&gt; we just switched to Sprint.