That was the missing piece! So that would mean that the Principal-name in the sun-web.xml looks at the Distinguished principal to compare the name. NOT all the principals in the Subject. And thus the group-name looks at the other principals.
I'm not sure exactly which document that little tidbit was hidden in, but thanks so much!
[Message sent by forum member 'athrawn17' (athrawn17)]
http://forums.java.net/jive/thread.jspa?messageID=258596