This all happens in the Wildfly code base, using Undertow handlers and ThreadSetupActions. org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction - This creates the picketbox security context and sets up the association. org.wildfly.extension.undertow.security.JAASIdentityManagerImpl - Populates the picketbox security context when the undertow Account is created. This is kinda yuck, but there is no other way to do this as far as I can see. org.wildfly.extension.undertow.security.SecurityContextAssociationHandler - Handles RunAs Stuart ----- Original Message -----