I working on an architecture design that has a messaging layer between my servlets and enterprise beans. Basically my servlet will publish a xml message to a MOM product which will call the appropriate enterprise beans. My question is how do I package the user identification up into a string when I create the message so the ejb can verify the user is logged in and within the appropriate roles? Once I get the information into the message, how do I tell Orion who I am before calling the beans? My users will be logging in through the jsp page and getting a valid Principal. Thanks, John