There are no methods on SecurityIdentity to create a run-as authorized user with a Principal, only a String name. There is no authorize(Principal) variant on ServerAuthenticationContext.

These should be added to support realms which do not use plain text names to identify users.