title: How to get roles with JSR 196 authentification in GlassFish?
body: <p>I want to use a custom authentication module conforming to <a href="http://jcp.org/en/jsr/detail?id=196" rel="nofollow noreferrer">JSR 196</a> in GlassFish 3. The interface javax.security.auth.message.ServerAuth has the method:</p>
  
  <pre><code>AuthStatus validateRequest(
    MessageInfo messageInfo,
    javax.security.auth.Subject clientSubject,
    javax.security.auth.Subject serviceSubject
  )
  </code></pre>
  
  <p>AuthStatus can be one of several constants like FAILURE or SUCCESS.</p>
  
  <p>The question is: <strong>How can I get the roles from a "role datebase" with JSR 196?</strong></p>
  
  <p>Example: The server receives a request with a SSO token (CAS token for example), checks whether the token is valid, populates the remote user object with roles fetches from a database via JDBC or from REST service via http.</p>
  
  <p>Is the role fetching in the scope of JSR 196? How could that be implemented?</p>
  
  <p>Do I have to use JSR 196 together with <a href="http://jcp.org/jsr/detail/115.jsp" rel="nofollow noreferrer">JSR 115</a> to use custom authentication and a custom role source?</p>