> The static groups are not the solution for my application because I
> don't know in advance how many cinemas will be entered, what will be
> their names, the relation between Users and Cinemas, and etc.
Ah, in that case you're right, my idea will definitely not work for you.
For your situation, I'm not sure what to tell you, so maybe someone else
can chime in. I don't know of a way in glassfish to update groups/roles
dynamically, but there may be another way to dynamically configure
permissions during runtime since all the resources are not known at startup.
> Why you do private case as principals instead to implements the real
> world situations which can solve private cases also?
Sorry, I don't think I understand the question.
Cheers,
Bobby