You can not do what you are trying to do the way you are going about it. To be more specific, if you choose container managed security, you do not have access to the Subject to add roles. I think what you need to do is add your custom loginmodule to the security domain your database login module is. If you need the IP address, then check out http://wiki.jboss.org/wiki/Wiki.jsp?page=AccessingServletRequestForAuthentication. If this will not work for, let us know more detail.