I want to use a custom authentication module conforming to JSR 196 in GlassFish 3. The interface javax.security.auth.message.ServerAuth has the method:

AuthStatus validateRequest(
  MessageInfo messageInfo,
  javax.security.auth.Subject clientSubject,
  javax.security.auth.Subject serviceSubject
)

AuthStatus can be one of several constants like FAILURE or SUCCESS.

The question is: How can I get the roles from a "role datebase" with JSR 196?

Example: The server receives a request with a SSO token (CAS token for example), checks whether the token is valid, populates the remote user object with roles fetches from a database via JDBC or from REST service via http.

Is the role fetching in the scope of JSR 196? How could that be implemented?

Do I have to use JSR 196 together with JSR 115 to use custom authentication and a custom role source?