Subject subject = new Subject();
// delegate to the external security system if possible
// authenticate the user somehow
subject.getPrincipals().add(new SimplePrincipal(name));
// add roles this user is in
String roleName = "Alice".equals(name) ? "developers" : "pms";
String expectedPassword = "Alice".equals(name) ? "ecilA"
: UsernameToken.doPasswordDigest(nonce, created, "knarF");