this sounds like an error in the policy implementation, or possibly in the activate of the unchecked permission cache via the reuse policy context handler.
the glassfish realm adapter establishes the value of the isMandatory, by calling WebSecurityManager.permitAll(request). isManadatory is set to the complementt of the value returned by permitAll.
can you trace your the calls to your policy provider that occur from permitAll?
Ron
[Message sent by forum member 'monzillo' (monzillo)]
http://forums.java.net/jive/thread.jspa?messageID=278608