According to the servlet 2.4 spec, the run-as should be used for Servlet.init()
" Clarification: run-as identity must apply to all calls from a servlet including init() and destroy() (12.7)"
This isn't working.
In JBoss 5.x, it looks like this functionality was implemented by a RunAsListener. However, that listener does not appear to exist in the EAP 6 code base.