If your component must run with a principal that is mapped to both roles, then it is probably best to define a new role that is only granted to users that are mapped to both of the individual roles. Then, in the sun specific deployment descriptor, you would configure a suitable run-as principal that in mapped to both roles.
you can also declare either of the underlying roles as the run-as role, and you could assign a run-as principal that is mapped to the declarfe run-as role, and the other role as well.
Ron
[Message sent by forum member 'monzillo' (monzillo)]
http://forums.java.net/jive/thread.jspa?messageID=299697