More gripping than a gripping spy novel: http://blog.infinispan.org/2014/04/infinispan-security-1-authorization.html Fortunately you don't need a valid javax.security.auth.Subject to be able to read it :) Tristan