diff --git a/client/src/main/java/org/teiid/net/socket/AuthenticationType.java b/client/src/main/java/org/teiid/net/socket/AuthenticationType.java
index f800b31..172bedf 100644
--- a/client/src/main/java/org/teiid/net/socket/AuthenticationType.java
+++ b/client/src/main/java/org/teiid/net/socket/AuthenticationType.java
@@ -23,19 +23,5 @@
 package org.teiid.net.socket;
 
 public enum AuthenticationType {
-	USERPASSWORD,GSS,ANY;
-	
-	public static AuthenticationType type(String str) {
-		if (str != null && str.equalsIgnoreCase(AuthenticationType.GSS.name())) {
-			return AuthenticationType.GSS;
-		}
-		return AuthenticationType.ANY;
-	}
-	
-	public static AuthenticationType prefer(String str) {
-		if (str != null && str.equalsIgnoreCase(AuthenticationType.GSS.name())) {
-			return AuthenticationType.GSS;
-		}
-		return AuthenticationType.USERPASSWORD;
-	}	
+	USERPASSWORD,GSS;
 }
\ No newline at end of file
diff --git a/client/src/main/java/org/teiid/net/socket/SocketServerConnection.java b/client/src/main/java/org/teiid/net/socket/SocketServerConnection.java
index 7aa8f97..93b74ba 100644
--- a/client/src/main/java/org/teiid/net/socket/SocketServerConnection.java
+++ b/client/src/main/java/org/teiid/net/socket/SocketServerConnection.java
@@ -51,7 +51,6 @@
 import org.teiid.core.TeiidException;
 import org.teiid.core.util.PropertiesUtils;
 import org.teiid.gss.MakeGSS;
-import org.teiid.jdbc.BaseDataSource;
 import org.teiid.jdbc.JDBCPlugin;
 import org.teiid.net.CommunicationException;
 import org.teiid.net.ConnectionException;
@@ -172,16 +171,25 @@
 		
 		updateConnectionProperties(connProps, instance.getLocalAddress(), true);
 
-		String user = connProps.getProperty(BaseDataSource.USER_NAME);
-		AuthenticationType authType  = AuthenticationType.prefer(user);
-		
 		LogonResult newResult = null;
-		if (AuthenticationType.USERPASSWORD.equals(authType)) {
+
+		// - if gss
+		if (connProps.contains(TeiidURL.CONNECTION.JAAS_NAME)) {
+			newResult = MakeGSS.authenticate(newLogon, connProps);
+		} else {
 			newResult = newLogon.logon(connProps);
 		}
-		else if (AuthenticationType.GSS.equals(authType)) {
-			newResult = MakeGSS.authenticate(newLogon, connProps);
-		}		
+
+		AuthenticationType type = (AuthenticationType) newResult.getProperty("authType");
+		
+		if (type != null) {
+			//server has issued an additional challange
+			if (type == AuthenticationType.GSS) {
+				newResult = MakeGSS.authenticate(newLogon, connProps);
+			} else {
+				//TODO: throw exception
+			}
+		}
 		
 		if (logoff) {
 			if ("07.03".compareTo(this.serverInstance.getServerVersion()) <= 0) { //$NON-NLS-1$
diff --git a/engine/src/main/java/org/teiid/dqp/internal/process/DQPWorkContext.java b/engine/src/main/java/org/teiid/dqp/internal/process/DQPWorkContext.java
index 43798d9..9dda41d 100644
--- a/engine/src/main/java/org/teiid/dqp/internal/process/DQPWorkContext.java
+++ b/engine/src/main/java/org/teiid/dqp/internal/process/DQPWorkContext.java
@@ -70,7 +70,8 @@
 		EIGHT_0("08.00", (byte)(longDatesTimes?0:1)), //$NON-NLS-1$
 		EIGHT_2("08.02", (byte)2), //$NON-NLS-1$
 		EIGHT_4("08.04.00.CR3", (byte)2), //$NON-NLS-1$
-		EIGHT_6("08.06.00.Beta3", (byte)3); //$NON-NLS-1$
+		EIGHT_6("08.06.00.Beta3", (byte)3), //$NON-NLS-1$
+		EIGHT_7("08.07.00.Beta2", (byte)3); //$NON-NLS-1$
 		
 		private String string;
 		private byte clientSerializationVersion;
diff --git a/engine/src/main/java/org/teiid/dqp/service/SessionService.java b/engine/src/main/java/org/teiid/dqp/service/SessionService.java
index c2e4f2f..280f89d 100644
--- a/engine/src/main/java/org/teiid/dqp/service/SessionService.java
+++ b/engine/src/main/java/org/teiid/dqp/service/SessionService.java
@@ -30,6 +30,7 @@
 
 import org.teiid.adminapi.impl.SessionMetadata;
 import org.teiid.client.security.InvalidSessionException;
+import org.teiid.client.security.LogonException;
 import org.teiid.dqp.internal.process.DQPCore;
 import org.teiid.net.socket.AuthenticationType;
 import org.teiid.security.Credentials;
@@ -120,7 +121,7 @@
 	
 	LoginContext createLoginContext(String securityDomain, String user, String password) throws LoginException;
 
-	AuthenticationType getAuthenticationType(String vdbName, String version, AuthenticationType preferType);
+	AuthenticationType getAuthenticationType(String vdbName, String version, String user) throws LogonException;
 	
 	String getSecurityDomain(String vdbName, String version);
 	
diff --git a/jboss-integration/src/main/java/org/teiid/jboss/TransportAdd.java b/jboss-integration/src/main/java/org/teiid/jboss/TransportAdd.java
index dcb4011..5a78427 100644
--- a/jboss-integration/src/main/java/org/teiid/jboss/TransportAdd.java
+++ b/jboss-integration/src/main/java/org/teiid/jboss/TransportAdd.java
@@ -21,7 +21,7 @@
  */
 package org.teiid.jboss;
 
-import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OP_ADDR;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.*;
 import static org.teiid.jboss.TeiidConstants.*;
 
 import java.util.List;
@@ -142,7 +142,7 @@
    			transport.setAuthenticationType(AuthenticationType.valueOf(AUTHENTICATION_TYPE_ATTRIBUTE.asString(operation, context)));
    		}
    		else {
-   			transport.setAuthenticationType(AuthenticationType.ANY);
+   			transport.setAuthenticationType(AuthenticationType.USERPASSWORD);
    		}
    		
    		if (PG_MAX_LOB_SIZE_ALLOWED_ELEMENT.isDefined(operation, context)) {
diff --git a/jboss-integration/src/main/java/org/teiid/jboss/TransportService.java b/jboss-integration/src/main/java/org/teiid/jboss/TransportService.java
index 7256267..daf9d2c 100644
--- a/jboss-integration/src/main/java/org/teiid/jboss/TransportService.java
+++ b/jboss-integration/src/main/java/org/teiid/jboss/TransportService.java
@@ -73,7 +73,7 @@
 import org.teiid.transport.WireProtocol;
 
 public class TransportService extends ClientServiceRegistryImpl implements Service<ClientServiceRegistry> {
-	private transient ILogon logon;
+	private transient LogonImpl logon;
 	private SocketConfiguration socketConfig;
 	final ConcurrentMap<String, SecurityDomainContext> securityDomains = new ConcurrentHashMap<String, SecurityDomainContext>();
 	private String authenticationDomain;	
@@ -128,7 +128,7 @@
 		this.sessionService.setSecurityHelper(this.getSecurityHelper());
 		this.sessionService.setAuthenticationType(getAuthenticationType());
 		this.sessionService.start();
-		this.setAuthenticationType(this.sessionService.getAuthenticationType(null, null, null));
+		this.setAuthenticationType(this.sessionService.getDefaultAuthenticationType());
 		
     	// create the necessary services
 		this.logon = new LogonImpl(this.sessionService, "teiid-cluster"); //$NON-NLS-1$
diff --git a/runtime/src/main/java/org/teiid/odbc/ODBCServerRemoteImpl.java b/runtime/src/main/java/org/teiid/odbc/ODBCServerRemoteImpl.java
index ad669e9..5e8c503 100644
--- a/runtime/src/main/java/org/teiid/odbc/ODBCServerRemoteImpl.java
+++ b/runtime/src/main/java/org/teiid/odbc/ODBCServerRemoteImpl.java
@@ -21,10 +21,7 @@
  */
 package org.teiid.odbc;
 
-import static org.teiid.odbc.PGUtil.PG_TYPE_FLOAT4;
-import static org.teiid.odbc.PGUtil.PG_TYPE_FLOAT8;
-import static org.teiid.odbc.PGUtil.PG_TYPE_NUMERIC;
-import static org.teiid.odbc.PGUtil.convertType;
+import static org.teiid.odbc.PGUtil.*;
 
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -53,6 +50,7 @@
 import org.teiid.core.util.ApplicationInfo;
 import org.teiid.core.util.StringUtil;
 import org.teiid.deployers.PgCatalogMetadataStore;
+import org.teiid.dqp.service.SessionService;
 import org.teiid.jdbc.ConnectionImpl;
 import org.teiid.jdbc.PreparedStatementImpl;
 import org.teiid.jdbc.ResultSetImpl;
@@ -66,6 +64,7 @@
 import org.teiid.query.parser.SQLParserUtil;
 import org.teiid.runtime.RuntimePlugin;
 import org.teiid.transport.LocalServerConnection;
+import org.teiid.transport.LogonImpl;
 import org.teiid.transport.ODBCClientInstance;
 import org.teiid.transport.PgBackendProtocol;
 import org.teiid.transport.PgFrontendProtocol.NullTerminatedStringDataInputStream;
@@ -176,9 +175,9 @@
 	private Map<String, Prepared> preparedMap = Collections.synchronizedMap(new HashMap<String, Prepared>());
 	private Map<String, Portal> portalMap = Collections.synchronizedMap(new HashMap<String, Portal>());
 	private Map<String, Cursor> cursorMap = Collections.synchronizedMap(new HashMap<String, Cursor>());
-	private ILogon logon;
+	private	LogonImpl logon;
 	
-	public ODBCServerRemoteImpl(ODBCClientInstance client, TeiidDriver driver, ILogon logon) {
+	public ODBCServerRemoteImpl(ODBCClientInstance client, TeiidDriver driver, LogonImpl logon) {
 		this.driver = driver;
 		this.client = client.getClient();
 		this.logon = logon;
@@ -190,13 +189,33 @@
 		this.client.initialized(this.props);
 
 		String user = props.getProperty("user"); //$NON-NLS-1$
-		AuthenticationType authType = AuthenticationType.prefer(user);
+		String database = props.getProperty("database");
+		
+		AuthenticationType authType = null;
+		try {
+			authType = getAuthenticationType(user, database);
+		} catch (LogonException e) {
+			errorOccurred(e);
+			terminate();
+		}
+		
 		if (authType.equals(AuthenticationType.USERPASSWORD)) {
 			this.client.useClearTextAuthentication();
 		}
 		else if (authType.equals(AuthenticationType.GSS)) {
 			this.client.useAuthenticationGSS();
+		} else {
+			throw new AssertionError("Unsupported Authentication Type"); //$NON-NLS-1$
 		}
+	}
+
+	private AuthenticationType getAuthenticationType(String user,
+			String database) throws LogonException {
+		SessionService ss = this.logon.getSessionService();
+		if (ss == null) {
+			return AuthenticationType.USERPASSWORD;
+		}
+		return ss.getAuthenticationType(database, null, user);
 	}
 
 	@Override
@@ -205,7 +224,7 @@
 			java.util.Properties info = new java.util.Properties();
 			info.put("user", user); //$NON-NLS-1$
 			
-			AuthenticationType authType = AuthenticationType.prefer(user);
+			AuthenticationType authType = getAuthenticationType(user, databaseName);
 			
 			String password = null; 
 			if (authType.equals(AuthenticationType.USERPASSWORD)) {
@@ -222,6 +241,8 @@
 	            	this.client.authenticationGSSContinue(serviceToken);
 	            	return;            		
             	}
+			} else {
+				throw new AssertionError("Unsupported Authentication Type"); //$NON-NLS-1$
 			}
 			
 			// this is local connection
diff --git a/runtime/src/main/java/org/teiid/runtime/RuntimePlugin.java b/runtime/src/main/java/org/teiid/runtime/RuntimePlugin.java
index 91f9d81..2ba1fb9 100644
--- a/runtime/src/main/java/org/teiid/runtime/RuntimePlugin.java
+++ b/runtime/src/main/java/org/teiid/runtime/RuntimePlugin.java
@@ -129,6 +129,5 @@
     	TEIID40115,
     	TEIID40116,
     	TEIID40117,
-    	TEIID40118
     }
 }
diff --git a/runtime/src/main/java/org/teiid/services/SessionServiceImpl.java b/runtime/src/main/java/org/teiid/services/SessionServiceImpl.java
index 504c9e8..71623a6 100644
--- a/runtime/src/main/java/org/teiid/services/SessionServiceImpl.java
+++ b/runtime/src/main/java/org/teiid/services/SessionServiceImpl.java
@@ -26,8 +26,16 @@
 import java.io.IOException;
 import java.security.Principal;
 import java.security.acl.Group;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Map;
+import java.util.Properties;
+import java.util.Set;
+import java.util.Timer;
+import java.util.TimerTask;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.regex.Pattern;
 
 import javax.security.auth.Subject;
 import javax.security.auth.callback.Callback;
@@ -43,6 +51,7 @@
 import org.teiid.adminapi.impl.SessionMetadata;
 import org.teiid.adminapi.impl.VDBMetaData;
 import org.teiid.client.security.InvalidSessionException;
+import org.teiid.client.security.LogonException;
 import org.teiid.client.security.SessionToken;
 import org.teiid.core.util.ArgCheck;
 import org.teiid.deployers.VDBRepository;
@@ -64,7 +73,10 @@
  * This class serves as the primary implementation of the Session Service.
  */
 public class SessionServiceImpl implements SessionService {
+	public static final String GSS_PATTERN_PROPERTY = "gss-pattern"; //$NON-NLS-1$
+	public static final String PASSWORD_PATTERN_PROPERTY = "password-pattern"; //$NON-NLS-1$
 	public static final String SECURITY_DOMAIN_PROPERTY = "security-domain"; //$NON-NLS-1$
+	public static final String AUTHENTICATION_TYPE_PROPERTY = "authentication-type"; //$NON-NLS-1$
 	public static final String AT = "@"; //$NON-NLS-1$
 	/*
 	 * Configuration state
@@ -410,38 +422,6 @@
 		return securityHelper;
 	}
 
-    protected Collection<String> getDomainsForUser(List<String> domains, String username) {
-    	// If username is null, return all domains
-        if (username == null) {
-            return domains;
-        }  
-        
-        String domain = getDomainName(username);
-        
-        if (domain == null) {
-        	return domains;
-        }
-        
-        // ------------------------------------------
-        // Handle usernames having @ sign
-        // ------------------------------------------
-        String domainHolder = null;
-        for (String d:domains) {
-        	if(d.equalsIgnoreCase(domain)) {
-        		domainHolder = d;
-        		break;
-        	}        	
-        }
-        
-        if (domainHolder == null) {
-            return Collections.emptyList();
-        }
-        
-        LinkedList<String> result = new LinkedList<String>();
-        result.add(domainHolder);
-        return result;
-    }	
-    
     protected static String getBaseUsername(String username) {
         if (username == null) {
             return username;
@@ -493,58 +473,36 @@
     }
     
 	@Override
-	public AuthenticationType getAuthenticationType(String vdbName, String version, AuthenticationType preferType) {
+	public AuthenticationType getAuthenticationType(String vdbName, String version, String userName) throws LogonException {
 		if (vdbName != null) {
-	    	try {    		
-				VDB vdb = getActiveVDB(vdbName, version);
-				String typeProperty = vdb.getPropertyValue(SECURITY_DOMAIN_PROPERTY);
-				if (typeProperty != null) {
-					return selectAuthType(preferType, parseAuthType(typeProperty));
-				}
-	    	} catch (SessionServiceException e) {
-				// ignore and return default, this only occur if the name and version are wrong 
-			}			
+			VDB vdb;
+			try {
+				vdb = getActiveVDB(vdbName, version);
+			} catch (SessionServiceException e) {
+				throw new LogonException(e);
+			}
+			
+			String gssPattern = vdb.getPropertyValue(GSS_PATTERN_PROPERTY);
+			
+			//TODO: cache the patterns
+			
+			if (gssPattern != null && Pattern.matches(gssPattern, userName)) {
+				return AuthenticationType.GSS;
+			}
+			
+			String passwordPattern = vdb.getPropertyValue(PASSWORD_PATTERN_PROPERTY);
+			
+			if (passwordPattern != null && Pattern.matches(passwordPattern, userName)) {
+				return AuthenticationType.USERPASSWORD;
+			}
+			
+			String typeProperty = vdb.getPropertyValue(AUTHENTICATION_TYPE_PROPERTY);
+			if (typeProperty != null) {
+				return AuthenticationType.valueOf(typeProperty);
+			}
 		}
-		return selectAuthType(preferType, this.defaultAuthenticationType);
+		return this.defaultAuthenticationType;
 	}
-
-	private AuthenticationType selectAuthType(AuthenticationType preferType, AuthenticationType authType) {
-		if (!authType.equals(AuthenticationType.ANY)) {
-			return authType;
-		}
-
-		if (preferType.equals(AuthenticationType.ANY)) {
-			return AuthenticationType.USERPASSWORD;
-		}
-		
-		return preferType;
-	}    
-	
-	/**
-	 * Parse Security-Domain String. Normal form: "security-domain/authentication-type", if authentication type
-	 * omitted it is considered as USERPASSWORD 
-	 */
-	private AuthenticationType parseAuthType(String str) {
-		str = str.trim();
-		int idx = str.indexOf('/');
-		if (idx == -1) {
-			return AuthenticationType.ANY;
-		}
-		return AuthenticationType.valueOf(str.substring(idx+1));		
-	}
-	
-	/**
-	 * Parse Security-Domain String. Normal form: "security-domain/authentication-type", if authentication type
-	 * omitted it is considered as USERPASSWORD 
-	 */
-	private String parseSecurityDomain(String str) {
-		str = str.trim();
-		int idx = str.indexOf('/');
-		if (idx == -1) {
-			return str;
-		}
-		return str.substring(0, idx);		
-	}	
 
 	@Override
 	public String getSecurityDomain(String vdbName, String version) {
@@ -553,7 +511,7 @@
 				VDB vdb = getActiveVDB(vdbName, version);
 				String typeProperty = vdb.getPropertyValue(SECURITY_DOMAIN_PROPERTY);				
 				if (typeProperty != null) {
-					return parseSecurityDomain(typeProperty);
+					return typeProperty;
 				}
 			} catch (SessionServiceException e) {
 				// ignore and return default, this only occur if the name and version are wrong 
@@ -567,4 +525,8 @@
 		// must be overridden in platform specific security domain
 		return null;
 	}    
+	
+	public AuthenticationType getDefaultAuthenticationType() {
+		return defaultAuthenticationType;
+	}
 }
diff --git a/runtime/src/main/java/org/teiid/transport/LogonImpl.java b/runtime/src/main/java/org/teiid/transport/LogonImpl.java
index 739711e..46d2fc6 100644
--- a/runtime/src/main/java/org/teiid/transport/LogonImpl.java
+++ b/runtime/src/main/java/org/teiid/transport/LogonImpl.java
@@ -41,6 +41,7 @@
 import org.teiid.core.util.Base64;
 import org.teiid.core.util.LRUCache;
 import org.teiid.dqp.internal.process.DQPWorkContext;
+import org.teiid.dqp.internal.process.DQPWorkContext.Version;
 import org.teiid.dqp.service.GSSResult;
 import org.teiid.dqp.service.SessionService;
 import org.teiid.dqp.service.SessionServiceException;
@@ -71,43 +72,51 @@
 		String vdbVersion = connProps.getProperty(BaseDataSource.VDB_VERSION);
 		String user = connProps.getProperty(BaseDataSource.USER_NAME);
 		
-		AuthenticationType authType = checkAuthTypeSupported(vdbName,vdbVersion, user);
+		AuthenticationType authType = this.service.getAuthenticationType(vdbName, vdbVersion, user);
 		
 		// the presence of the KRB5 token take as GSS based login.
-		if (AuthenticationType.GSS.equals(authType)	&& connProps.get(ILogon.KRB5TOKEN) != null) {
-			Object previous = null;
-			boolean assosiated = false;
-			SecurityHelper securityHelper = service.getSecurityHelper();
-			try {
-				byte[] krb5Token = (byte[])connProps.get(ILogon.KRB5TOKEN);
-				Object securityContext = this.gssServiceTickets.remove(Base64.encodeBytes(MD5(krb5Token)));
-				if (securityContext == null) {
-					 throw new LogonException(RuntimePlugin.Event.TEIID40054, RuntimePlugin.Util.gs(RuntimePlugin.Event.TEIID40054));
-				}				
-				previous = securityHelper.associateSecurityContext(securityContext);
-				assosiated = true;
-				return logon(connProps, krb5Token, AuthenticationType.GSS);
-			} finally {
-				if (assosiated) {
-					securityHelper.associateSecurityContext(previous);
+		if (connProps.get(ILogon.KRB5TOKEN) != null) {
+			if (authType == AuthenticationType.GSS) {
+				Object previous = null;
+				boolean assosiated = false;
+				SecurityHelper securityHelper = service.getSecurityHelper();
+				try {
+					byte[] krb5Token = (byte[])connProps.get(ILogon.KRB5TOKEN);
+					Object securityContext = this.gssServiceTickets.remove(Base64.encodeBytes(MD5(krb5Token)));
+					if (securityContext == null) {
+						 throw new LogonException(RuntimePlugin.Event.TEIID40054, RuntimePlugin.Util.gs(RuntimePlugin.Event.TEIID40054));
+					}				
+					previous = securityHelper.associateSecurityContext(securityContext);
+					assosiated = true;
+					return logon(connProps, krb5Token, AuthenticationType.GSS);
+				} finally {
+					if (assosiated) {
+						securityHelper.associateSecurityContext(previous);
+					}
 				}
+			} else {
+				//shouldn't really get here, but we'll try user name password anyway
 			}
-		}		
+		} else if (authType == AuthenticationType.GSS) {
+			Version v = DQPWorkContext.getWorkContext().getClientVersion();
+			//send a login result with a GSS challange
+			if (v.compareTo(Version.EIGHT_7) >= 0) {
+				LogonResult result = new LogonResult();
+				result.addProperty("authType", authType); //$NON-NLS-1$
+				return result;
+			}
+			//throw an exception
+			throw new LogonException(RuntimePlugin.Event.TEIID40055, RuntimePlugin.Util.gs(RuntimePlugin.Event.TEIID40055, authType));
+		}
+		
+		//default to username password
+		
 		if (!AuthenticationType.USERPASSWORD.equals(authType)) {
 			 throw new LogonException(RuntimePlugin.Event.TEIID40055, RuntimePlugin.Util.gs(RuntimePlugin.Event.TEIID40055, authType));
 		}		
 		return logon(connProps, null, AuthenticationType.USERPASSWORD);
 	}
 
-	private AuthenticationType checkAuthTypeSupported(String vdbName, String vdbVersion, String user) throws LogonException {
-		AuthenticationType preferredAuthType = 	AuthenticationType.prefer(user);
-		AuthenticationType authType = this.service.getAuthenticationType(vdbName, vdbVersion, preferredAuthType);		
-		if (preferredAuthType != null && !preferredAuthType.equals(authType) && !preferredAuthType.equals(AuthenticationType.ANY)) {
-			 throw new LogonException(RuntimePlugin.Event.TEIID40118, RuntimePlugin.Util.gs(RuntimePlugin.Event.TEIID40118, preferredAuthType.name()));
-		}
-		return authType;
-	}
-	
 	private LogonResult logon(Properties connProps, byte[] krb5ServiceTicket, AuthenticationType authType) throws LogonException {
 
 		String vdbName = connProps.getProperty(BaseDataSource.VDB_NAME);
@@ -149,9 +158,9 @@
 		String vdbVersion = connProps.getProperty(BaseDataSource.VDB_VERSION);
 		String user = connProps.getProperty(BaseDataSource.USER_NAME);
 		
-		AuthenticationType authType = checkAuthTypeSupported(vdbName,vdbVersion, user);
+		AuthenticationType authType = this.service.getAuthenticationType(vdbName, vdbVersion, user);
 		
-		if (!AuthenticationType.GSS.equals(authType) || !AuthenticationType.ANY.equals(authType)) {
+		if (!AuthenticationType.GSS.equals(authType)) {
 			 throw new LogonException(RuntimePlugin.Event.TEIID40055, RuntimePlugin.Util.gs(RuntimePlugin.Event.TEIID40055, "Kerberos")); //$NON-NLS-1$
 		}
 		
@@ -263,4 +272,8 @@
 		}
 		this.updateDQPContext(sessionInfo);
 	}
+	
+	public SessionService getSessionService() {
+		return service;
+	}
 }
diff --git a/runtime/src/main/java/org/teiid/transport/ODBCClientInstance.java b/runtime/src/main/java/org/teiid/transport/ODBCClientInstance.java
index 466fb72..702b78e 100644
--- a/runtime/src/main/java/org/teiid/transport/ODBCClientInstance.java
+++ b/runtime/src/main/java/org/teiid/transport/ODBCClientInstance.java
@@ -28,7 +28,6 @@
 import java.util.Arrays;
 import java.util.concurrent.ConcurrentLinkedQueue;
 
-import org.teiid.client.security.ILogon;
 import org.teiid.core.util.ReflectionHelper;
 import org.teiid.jdbc.TeiidDriver;
 import org.teiid.logging.LogConstants;
@@ -50,7 +49,7 @@
 	private ReflectionHelper serverProxy = new ReflectionHelper(ODBCServerRemote.class);
 	private ConcurrentLinkedQueue<PGRequest> messageQueue = new ConcurrentLinkedQueue<PGRequest>();
 	
-	public ODBCClientInstance(final ObjectChannel channel, TeiidDriver driver, ILogon logonService) {
+	public ODBCClientInstance(final ObjectChannel channel, TeiidDriver driver, LogonImpl logonService) {
 		this.client = (ODBCClientRemote)Proxy.newProxyInstance(this.getClass().getClassLoader(), new Class[] {ODBCClientRemote.class}, new InvocationHandler() {
 			@Override
 			public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
diff --git a/runtime/src/main/java/org/teiid/transport/ODBCSocketListener.java b/runtime/src/main/java/org/teiid/transport/ODBCSocketListener.java
index adcbf8a..8ca4f43 100644
--- a/runtime/src/main/java/org/teiid/transport/ODBCSocketListener.java
+++ b/runtime/src/main/java/org/teiid/transport/ODBCSocketListener.java
@@ -25,7 +25,6 @@
 
 import org.jboss.netty.channel.ChannelPipeline;
 import org.jboss.netty.channel.DefaultChannelPipeline;
-import org.teiid.client.security.ILogon;
 import org.teiid.common.buffer.StorageManager;
 import org.teiid.jdbc.TeiidDriver;
 import org.teiid.net.socket.ObjectChannel;
@@ -34,9 +33,9 @@
 	private int maxBufferSize = Integer.parseInt(System.getProperty("org.teiid.ODBCPacketSize", "307200")); //$NON-NLS-1$ //$NON-NLS-2$
 	private int maxLobSize;
 	private TeiidDriver driver;
-	private ILogon logonService;
+	private LogonImpl logonService;
 	
-	public ODBCSocketListener(InetSocketAddress address, SocketConfiguration config, final ClientServiceRegistryImpl csr, StorageManager storageManager, int maxLobSize, ILogon logon, TeiidDriver driver) {
+	public ODBCSocketListener(InetSocketAddress address, SocketConfiguration config, final ClientServiceRegistryImpl csr, StorageManager storageManager, int maxLobSize, LogonImpl logon, TeiidDriver driver) {
 		//the clientserviceregistry isn't actually used by ODBC 
 		super(address, config, csr, storageManager);
 		this.maxLobSize = maxLobSize;
diff --git a/runtime/src/main/resources/org/teiid/runtime/i18n.properties b/runtime/src/main/resources/org/teiid/runtime/i18n.properties
index e648b06..3379390 100644
--- a/runtime/src/main/resources/org/teiid/runtime/i18n.properties
+++ b/runtime/src/main/resources/org/teiid/runtime/i18n.properties
@@ -117,4 +117,3 @@
 TEIID40115=Local pass-through connection implicitly closing session {0} so that the connection can be used in a different security context.
 TEIID40116=No Security Domain configured for Teiid for authentication
 TEIID40117=No authentication being performed as part of this connection request.
-TEIID40118=Preferred Authentication type {0} can not be performed; Authentication is only allowed on configured authentication mechanisms in server. 
\ No newline at end of file
diff --git a/runtime/src/test/java/org/teiid/services/TestSessionServiceImpl.java b/runtime/src/test/java/org/teiid/services/TestSessionServiceImpl.java
index 7e8cd3b..55df686 100644
--- a/runtime/src/test/java/org/teiid/services/TestSessionServiceImpl.java
+++ b/runtime/src/test/java/org/teiid/services/TestSessionServiceImpl.java
@@ -1,7 +1,6 @@
 package org.teiid.services;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.Assert.*;
 
 import java.util.Properties;
 
@@ -163,27 +162,27 @@
 		vdb.setVersion(1);
 		vdb.setStatus(Status.ACTIVE);
 		vdb.addProperty(SessionServiceImpl.SECURITY_DOMAIN_PROPERTY, "domain");
-		
+		vdb.addProperty(SessionServiceImpl.GSS_PATTERN_PROPERTY, "x");
 		Mockito.stub(repo.getLiveVDB("name", 1)).toReturn(vdb);
 		
 		ssi.setVDBRepository(repo);
 		ssi.setAuthenticationType(AuthenticationType.USERPASSWORD); // this is transport default
 
-		assertEquals(AuthenticationType.GSS, ssi.getAuthenticationType("name", "1", AuthenticationType.GSS));
-		assertEquals(AuthenticationType.USERPASSWORD, ssi.getAuthenticationType("name", "1", AuthenticationType.USERPASSWORD));
-		assertEquals(AuthenticationType.USERPASSWORD, ssi.getAuthenticationType("name", "1", AuthenticationType.ANY));
+		assertEquals(AuthenticationType.GSS, ssi.getAuthenticationType("name", "1", "x"));
+		assertEquals(AuthenticationType.USERPASSWORD, ssi.getAuthenticationType("name", "1", "y"));
+		assertEquals(AuthenticationType.USERPASSWORD, ssi.getAuthenticationType("name", "1", "z"));
 		
 		// testing specific domain, enforcing 
 		vdb = new VDBMetaData();
 		vdb.setName("name1");
 		vdb.setVersion(1);
 		vdb.setStatus(Status.ACTIVE);
-		vdb.addProperty(SessionServiceImpl.SECURITY_DOMAIN_PROPERTY, "domain/GSS");
-		
+		vdb.addProperty(SessionServiceImpl.SECURITY_DOMAIN_PROPERTY, "domain");
+		vdb.addProperty(SessionServiceImpl.AUTHENTICATION_TYPE_PROPERTY, "GSS");
 		Mockito.stub(repo.getLiveVDB("name1", 1)).toReturn(vdb);
 
-		assertEquals(AuthenticationType.GSS, ssi.getAuthenticationType("name1", "1", AuthenticationType.GSS));
-		assertEquals(AuthenticationType.GSS, ssi.getAuthenticationType("name1", "1", AuthenticationType.USERPASSWORD));
+		assertEquals(AuthenticationType.GSS, ssi.getAuthenticationType("name1", "1", "x"));
+		assertEquals(AuthenticationType.GSS, ssi.getAuthenticationType("name1", "1", "y"));
 		
 		// testing transport default
 		vdb = new VDBMetaData();
@@ -193,12 +192,12 @@
 		
 		Mockito.stub(repo.getLiveVDB("name2", 1)).toReturn(vdb);
 
-		assertEquals(AuthenticationType.USERPASSWORD, ssi.getAuthenticationType("name2", "1", AuthenticationType.GSS));
-		assertEquals(AuthenticationType.USERPASSWORD, ssi.getAuthenticationType("name2", "1", AuthenticationType.ANY));		
+		assertEquals(AuthenticationType.USERPASSWORD, ssi.getAuthenticationType("name2", "1", "x"));
+		assertEquals(AuthenticationType.USERPASSWORD, ssi.getAuthenticationType("name2", "1", "y"));		
 		
-		ssi.setAuthenticationType(AuthenticationType.ANY); // this is transport default
-		assertEquals(AuthenticationType.GSS, ssi.getAuthenticationType("name2", "1", AuthenticationType.GSS));
-		assertEquals(AuthenticationType.USERPASSWORD, ssi.getAuthenticationType("name2", "1", AuthenticationType.ANY));		
+		ssi.setAuthenticationType(AuthenticationType.GSS); // this is transport default
+		assertEquals(AuthenticationType.GSS, ssi.getAuthenticationType("name2", "1", "x"));
+		assertEquals(AuthenticationType.GSS, ssi.getAuthenticationType("name2", "1", "y"));		
 		
 	}	
 	
diff --git a/runtime/src/test/java/org/teiid/transport/TestFailover.java b/runtime/src/test/java/org/teiid/transport/TestFailover.java
index f73291e..70a17da 100644
--- a/runtime/src/test/java/org/teiid/transport/TestFailover.java
+++ b/runtime/src/test/java/org/teiid/transport/TestFailover.java
@@ -22,17 +22,14 @@
  */
 package org.teiid.transport;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.mockito.Mockito.mock;
+import static org.junit.Assert.*;
+import static org.mockito.Mockito.*;
 
 import java.net.InetSocketAddress;
 import java.util.Properties;
 
 import org.junit.After;
 import org.junit.Test;
-import org.mockito.Mockito;
 import org.teiid.client.security.ILogon;
 import org.teiid.client.security.InvalidSessionException;
 import org.teiid.client.security.LogonException;
@@ -46,7 +43,6 @@
 import org.teiid.net.ConnectionException;
 import org.teiid.net.HostInfo;
 import org.teiid.net.TeiidURL;
-import org.teiid.net.socket.AuthenticationType;
 import org.teiid.net.socket.SocketServerConnection;
 import org.teiid.net.socket.SocketServerConnectionFactory;
 import org.teiid.net.socket.UrlServerDiscovery;
@@ -100,7 +96,6 @@
 			}
 		};
 		SessionService ss = mock(SessionService.class);
-		Mockito.stub(ss.getAuthenticationType(Mockito.anyString(), Mockito.anyString(), Mockito.any(AuthenticationType.class))).toReturn(AuthenticationType.USERPASSWORD);
 		server.registerClientService(ILogon.class, new LogonImpl(ss, "fakeCluster") { //$NON-NLS-1$
 			@Override
 			public LogonResult logon(Properties connProps)
diff --git a/runtime/src/test/java/org/teiid/transport/TestLogonImpl.java b/runtime/src/test/java/org/teiid/transport/TestLogonImpl.java
index 2bdb031..ec62d5d 100644
--- a/runtime/src/test/java/org/teiid/transport/TestLogonImpl.java
+++ b/runtime/src/test/java/org/teiid/transport/TestLogonImpl.java
@@ -23,8 +23,7 @@
 
 package org.teiid.transport;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.Assert.*;
 
 import java.util.Properties;
 
@@ -77,7 +76,7 @@
 	@Test
 	public void testLogonResult() throws Exception {
 		SessionService ssi = Mockito.mock(SessionService.class);
-		Mockito.stub(ssi.getAuthenticationType(Mockito.anyString(), Mockito.anyString(), Mockito.any(AuthenticationType.class))).toReturn(AuthenticationType.USERPASSWORD);
+		Mockito.stub(ssi.getAuthenticationType(Mockito.anyString(), Mockito.anyString(), Mockito.anyString())).toReturn(AuthenticationType.USERPASSWORD);
 		Mockito.stub(ssi.getSecurityDomain(Mockito.anyString(), Mockito.anyString())).toReturn("SC");
 		DQPWorkContext.setWorkContext(new DQPWorkContext());
 		String userName = "Fred"; //$NON-NLS-1$
@@ -105,6 +104,7 @@
 	public void testLogonAuthenticationType() throws Exception {
 		VDBRepository repo = Mockito.mock(VDBRepository.class);
 		VDBMetaData vdb = new VDBMetaData();
+		vdb.addProperty(SessionServiceImpl.GSS_PATTERN_PROPERTY, "GSS");
 		vdb.setName("name");
 		vdb.setVersion(1);
 		vdb.setStatus(Status.ACTIVE);
@@ -122,7 +122,7 @@
 		assertEquals("fred", result.getUserName());
 		
 		// if no preference then choose USERPASSWORD
-		ssi.setAuthenticationType(AuthenticationType.ANY); // this is transport default		
+		ssi.setAuthenticationType(AuthenticationType.USERPASSWORD); // this is transport default		
 		DQPWorkContext.setWorkContext(new DQPWorkContext());
 		p = buildProperties("fred", "name");		
 		impl = new LogonImpl(ssi, "fakeCluster"); //$NON-NLS-1$
@@ -130,7 +130,7 @@
 		assertEquals("fred", result.getUserName());
 
 		// if user name is set to "GSS", then the preference is set to "GSS"
-		ssi.setAuthenticationType(AuthenticationType.ANY); // this is transport default		
+		ssi.setAuthenticationType(AuthenticationType.USERPASSWORD); // this is transport default		
 		DQPWorkContext.setWorkContext(new DQPWorkContext());
 		p = buildProperties("GSS", "name");		
 		FakeGssLogonImpl fimpl = new FakeGssLogonImpl(ssi, "fakeCluster"); //$NON-NLS-1$
@@ -161,7 +161,7 @@
 		ssi.setAuthenticationType(AuthenticationType.GSS); 
 		
 		// default transport - what Teiid has before TEIID-2863
-		addVdb(repo, "name", "SC/USERPASSWORD");		
+		addVdb(repo, "name", "SC", AuthenticationType.USERPASSWORD.name());		
 		DQPWorkContext.setWorkContext(new DQPWorkContext());
 		Properties p = buildProperties("fred", "name");		
 		LogonImpl impl = new LogonImpl(ssi, "fakeCluster"); //$NON-NLS-1$
@@ -169,7 +169,8 @@
 		assertEquals("fred", result.getUserName());
 		
 		// if no preference then choose USERPASSWORD
-		addVdb(repo, "name1", "SC");		
+		VDBMetaData metadata = addVdb(repo, "name1", "SC", AuthenticationType.USERPASSWORD.name());
+		metadata.addProperty(SessionServiceImpl.GSS_PATTERN_PROPERTY, "GSS");
 		DQPWorkContext.setWorkContext(new DQPWorkContext());
 		impl = new LogonImpl(ssi, "fakeCluster"); //$NON-NLS-1$
 		p = buildProperties("fred", "name1");		
@@ -189,14 +190,13 @@
 			p = buildProperties("GSS", "name");		
 			result = impl.logon(p);
 			assertEquals("GSS", result.getUserName());
-			fail("should have failed due server does not support GSS");
 		} catch(LogonException e) {
 			
 		}
 				
 		// if the transport default defined as GSS, then preference is USERPASSWORD, throw exception
 		try {
-			addVdb(repo, "name2", "SC/GSS");		
+			addVdb(repo, "name2", "SC", "GSS");		
 			DQPWorkContext.setWorkContext(new DQPWorkContext());
 			impl = new LogonImpl(ssi, "fakeCluster"); //$NON-NLS-1$
 			p = buildProperties("fred", "name2");		
@@ -216,13 +216,15 @@
 		return p;
 	}
 
-	private void addVdb(VDBRepository repo, String name, String sc) {
+	private VDBMetaData addVdb(VDBRepository repo, String name, String sc, String authenticationType) {
 		VDBMetaData vdb = new VDBMetaData();
 		vdb.setName(name);
 		vdb.setVersion(1);
 		vdb.setStatus(Status.ACTIVE);
 		Mockito.stub(repo.getLiveVDB(name, 1)).toReturn(vdb);
 		vdb.addProperty(SessionServiceImpl.SECURITY_DOMAIN_PROPERTY, sc);
+		vdb.addProperty(SessionServiceImpl.AUTHENTICATION_TYPE_PROPERTY, authenticationType);
+		return vdb;
 	}	
 	
 	class FakeGssLogonImpl extends LogonImpl {
diff --git a/test-integration/common/src/test/java/org/teiid/transport/TestODBCSocketTransport.java b/test-integration/common/src/test/java/org/teiid/transport/TestODBCSocketTransport.java
index 0a77aa5..7b64022 100644
--- a/test-integration/common/src/test/java/org/teiid/transport/TestODBCSocketTransport.java
+++ b/test-integration/common/src/test/java/org/teiid/transport/TestODBCSocketTransport.java
@@ -22,11 +22,7 @@
 
 package org.teiid.transport;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.*;
 
 import java.io.IOException;
 import java.net.InetAddress;
@@ -56,7 +52,6 @@
 import org.mockito.Mockito;
 import org.postgresql.Driver;
 import org.postgresql.core.v3.ExtendedQueryExectutorImpl;
-import org.teiid.client.security.ILogon;
 import org.teiid.common.buffer.BufferManagerFactory;
 import org.teiid.core.util.UnitTestUtil;
 import org.teiid.jdbc.FakeServer;
@@ -145,7 +140,7 @@
 			config.setBindAddress(addr.getHostName());
 			config.setPortNumber(addr.getPort());
 			server = new FakeServer(true);
-			ILogon logon = Mockito.mock(ILogon.class);
+			LogonImpl logon = Mockito.mock(LogonImpl.class);
 			odbcTransport = new ODBCSocketListener(addr, config, Mockito.mock(ClientServiceRegistryImpl.class), BufferManagerFactory.getStandaloneBufferManager(), 100000, logon, server.getDriver());
 			odbcTransport.setMaxBufferSize(1000); //set to a small size to ensure buffering over the limit works
 			server.deployVDB("parts", UnitTestUtil.getTestDataPath() + "/PartsSupplier.vdb");