authentication is done by the appserver. jBPM just get's a string from that.
The resolving of the supervisor/employee relation is done by the identity module (see the testcases in the source). You have to implement your own to get what you want.
OK, i am trying to implement it, can I delete the Entity class and make the User, Group, Membership inherit from my legacy entities?