In the absence of a more elegant answer, I'm using the below. This seems fragile, and depends on the implementation of principals to remain unchanged, but will do as a stop gap...

    public static Identity getIdentity()
    {
        Principal callerPrincipal = SecurityAssociation.getCallerPrincipal();

        if(callerPrincipal == null)
        {
            return ANONYMOUS_IDENTITY;
        }

        try
        {
            String           name       = callerPrincipal.getName();
            RoleGroup        roles      = RoleFactory.createRoleGroup("RoleGroup");
            Set rolegroups = SecurityAssociation.getSubject().getPrincipals(SimpleGroup.class);

            for(SimpleGroup group : rolegroups)
            {
                Enumeration members = group.members();

                while(members.hasMoreElements())
                {
                    roles.addRole(RoleFactory.createRole(members.nextElement().getName()));
                }
            }

            return IdentityFactory.createIdentityWithRole(name, roles);
        }
        catch(Exception e)
        {
            throw new EJBAccessException("User's identity could not be determined: " + callerPrincipal.getName());
        }
    }