In Page 591,When a client call a method, the container always knows the client's principal, which includes the abstract security roles the Deployer assigned to the Principal. Is itDeployer or it should be Application Assembler?
I think it is deployer. Application assembler gives the abstract role and deployer maps the abstract role to the actual role (which he assigned in the application server).
