Maybe I don't understand the purpose of this discussion right, but doesn't JAAS Subject provide already a composition of different identities of an entity with corresponding credentials? I know that it's credentials are not serializable, thus cannot be propagated across VMs, but they may be serialized separately.