For thread based usage, you will need to know the name of the security domain for your application. Then, you need to establish a security context on the thread:

SecurityContext sc = SecurityContextFactory.createSecurityContext(string securitydomainname, Principal, Object, Subject);
SecurityContextAssociation.setSecurityContext(sc);

In JBAS5, you can inject a SubjectFactory and forget about internal details of security.

private Subject getSubject()
 {
 Subject subject = null;
 if(subjectFactory != null && securityDomainJndiName != null)
 {
 subject = subjectFactory.createSubject(securityDomainJndiName);
 }
 if (trace)
 log.trace("subject: " + subject);
 return subject;
 }