Custom Authorization Logic Using request.isUserInRole(role) in Weblogic 11g

Question

Dear All,
I am using BlazeDS and its security feature LoginCommand to implement a secured endpoint in Weblogic 11g. Since BlazsDS's default implementation uses HTTP session but we do not want to use it, we would like to implement our own version of authentication and authorization. However we faced a problem on authorization part.
For authentication, we use weblogic.security.services.Authentication.login(username, password), which returns correctly. For authorization, we try to use HttpServletRequest.isUserInRole(role) to determine whether a user belongs to a target role, but it returns false.
When we trying to fix the problem, we add weblogic.servlet.security.ServletAuthentication.login(username, password, request, response) before weblogic.security.services.Authentication.login(username, password), which will add information on HTTP session. It makes the later authorization using HttpServletRequest.isUserInRole(role) return true.
We want to know:
1. How can we check if an account belongs to a target role without using HTTP session in web application?
2. After we call Authentication.login(username, password), anything we need to do to log out for releasing any resource used?
3. If request.isUserInRole(role) is the only possible way to check if an account belongs to a target role, how to check the reason why it returns false?
And here is how we set up user, group and role:
User (in WebLogic Admin Console) – demo_user with demo_grp
Group (in WebLogic Admin Console) – demo_grp with patent demo_grp1
Role (in weblogic-application.xml) – demo_role maps to demo_grp1
We set nothing in web.xml as we want to use the security feature provide by BlazeDS to secure an endpoint at method level.
Remarks:
For Authorization in BlazeDS, what we have is the authenticated user's principal, and the required role of the calling method:
public boolean doAuthorization(Principal principal, List roles);
Thanks In Advance,
Alex

Answer 1

You gotta specify your child table recon-field in the process definition mappings as a Key Field. Refer OOTB AD connector and check:
Process Definition -> AD User ->Reconciliation Field Mappings -> memberOf