title: How can a JACC provider use the Principal-to-role mapping facilities of the server it's deployed on?
body: <p>I am writing a <code>JACC</code> provider.</p>
  
  <p>Along the way, this means implementing a <a href="http://download.oracle.com/javaee/6/api/javax/security/jacc/PolicyConfiguration.html" rel="noreferrer"><code>PolicyConfiguration</code></a>.</p>
  
  <p>The <code>PolicyConfiguration</code> is responsible for accepting configuration information from the application server, such as which permissions accrue to which roles.  This is so that a <a href="http://download.oracle.com/javase/6/docs/api/java/security/Policy.html" rel="noreferrer"><code>Policy</code></a> later on can make authorization decisions when handed <a href="http://download.oracle.com/javase/6/docs/api/java/security/ProtectionDomain.html" rel="noreferrer">information about the current user</a> and what he's trying to do.</p>
  
  <p>However, it is not part of the <code>PolicyConfiguration</code>'s (atrocious) contract to maintain a mapping between roles and their permissions, and <code>Principals</code> that are assigned to those roles.</p>
  
  <p>Typically--always, really--an application server houses this mapping.  For example, on Glassfish, you affect this mapping by supplying things like <code>sun-web.xml</code> and <code>sun-ejb-jar.xml</code> and so on with your Java EE modules.  (These vendor-specific files are responsible for saying, e.g., <code>superusers</code> is a group that is to be assigned the application role of <code>admins</code>.)</p>
  
  <p>I would like to reuse the functionality these files supply, and I would like to do so for as wide an array of application servers as possible.</p>
  
  <p>Here is--totally arbitrarily--IBM's take on the matter, which appears to confirm my suspicion that what <a href="http://publib.boulder.ibm.com/infocenter/wasinfo/v6r0/index.jsp?topic=/com.ibm.websphere.express.doc/info/exp/ae/csec_jaccextensions.html" rel="noreferrer">I want to do is essentially impossible</a>. (More ammunition for my case that this particular Java EE contract is not worth the paper it's printed on.)</p>
  
  <p><strong>My question:</strong> how do I get at this principal-to-role-mapping information in--for starters--Glassfish and JBoss from within a <code>PolicyConfiguration</code>?  If there's a standard way to do it that I'm unaware of, I'm all ears.</p>