Hi, what I think are bugs in the Identity Module for jBPM are the following:
1. In the Identity module documentation, theres a diagram that shows a parent-child relationship between Groups. In the code you can indeed add children to a Group, but it is not being persisted. I added an aditional PARENT_ field to the JBPM_ID_GROUP table, and I added the respective mapping to Group.hbm.xml, and it is working.
2. IdentitySession has a method verify that is supposed to validate an User against the JBPM_ID_USER table, but the query is incorrectly written, as it references an inexistent property password.text, which I changed to user.password and it works now.
Thought you might like to look at it, ;)