>> where the usernameLookupStrategy is the CanonicalUsernameLookupStrategy > > You shouldn't use that function, the proper place to get the username once authentication is done is the SubjectContext (child of PRC). > That works. Thanks. If I should have known, where would I have found out? Jim