Ideally we would need the Metro stack to have the same degree of JAAS integration the native stack has (i.e. authentication and authorization delegated to JBoss Security).