Ron Monzillo's Weblog

When you deploy a portable application or module on Glassfish, you don't need to define an application specific principal to role mapping. Glassfish allows you to activate a default mapping that will be applied on behalf of all applications that are (subsequently) deployed without an application specific mapping. This feature of glassfish is described in more detail in: Roles, Principals, and Principal to Role Mapping. The default mapping is canonical in that it maps groups to same-named roles. For example group principal "user" is mapped to role "user". Applications or modules deployed before the default mapping is activated, are unaffected.