Seams my problem with SecurityAssociation is within a portected URL the SubjectContext is null
2006-07-09 14:57:37,745 TRACE [org.jboss.security.SecurityAssociation] getSubject, sc=null
A bit more.
This only happens when the authenticated user does not have the proper role to access the URL.
I did forget to add, I am looking for the subject in a Valve.