diff --git a/auth/realm/base/src/main/java/org/wildfly/security/auth/realm/JaasSecurityRealm.java b/auth/realm/base/src/main/java/org/wildfly/security/auth/realm/JaasSecurityRealm.java
index 734aadac72..0184519667 100644
--- a/auth/realm/base/src/main/java/org/wildfly/security/auth/realm/JaasSecurityRealm.java
+++ b/auth/realm/base/src/main/java/org/wildfly/security/auth/realm/JaasSecurityRealm.java
@@ -172,6 +172,11 @@ public class JaasSecurityRealm implements SecurityRealm {
             return subject;
         }
 
+        @Override
+        public void setSubject(Subject subject) {
+            this.subject = subject;
+        }
+
         @Override
         public SupportLevel getCredentialAcquireSupport(final Class<? extends Credential> credentialType, final String algorithmName, final AlgorithmParameterSpec parameterSpec) throws RealmUnavailableException {
             return JaasSecurityRealm.this.getCredentialAcquireSupport(credentialType, algorithmName, parameterSpec);
diff --git a/auth/server/base/src/main/java/org/wildfly/security/auth/callback/CachedIdentityAuthorizeCallback.java b/auth/server/base/src/main/java/org/wildfly/security/auth/callback/CachedIdentityAuthorizeCallback.java
index 7bb1d441df..b1d130f8e0 100644
--- a/auth/server/base/src/main/java/org/wildfly/security/auth/callback/CachedIdentityAuthorizeCallback.java
+++ b/auth/server/base/src/main/java/org/wildfly/security/auth/callback/CachedIdentityAuthorizeCallback.java
@@ -20,12 +20,16 @@ package org.wildfly.security.auth.callback;
 
 import org.wildfly.common.Assert;
 import org.wildfly.security.auth.principal.NamePrincipal;
+import org.wildfly.security.auth.server.RealmIdentity;
 import org.wildfly.security.auth.server.SecurityDomain;
 import org.wildfly.security.auth.server.SecurityIdentity;
 import org.wildfly.security.cache.CachedIdentity;
 import org.wildfly.security.cache.IdentityCache;
 
+import javax.security.auth.Subject;
+
 import java.security.Principal;
+import java.util.Set;
 import java.util.function.Function;
 
 import static org.wildfly.common.Assert.checkNotNullParam;
@@ -162,6 +166,20 @@ public class CachedIdentityAuthorizeCallback implements ExtendedCallback {
         }
     }
 
+    public void setSubject(RealmIdentity realmIdentity) {
+        Subject subject = realmIdentity.getSubject();
+        if (subject == null) {
+            CachedIdentity cachedIdentity = createDomainCache().get();
+            if (cachedIdentity != null) {
+                subject = new Subject();
+                Set<Principal> principals = subject.getPrincipals();
+                principals.add(realmIdentity.getRealmIdentityPrincipal());
+                cachedIdentity.getRoles().forEach(role -> principals.add(Roles.of(role)));
+                realmIdentity.setSubject(subject);
+            }
+        }
+    }
+
     /**
      * Returns the {@link Principal} representing the cached identity.
      *
@@ -229,4 +247,22 @@ public class CachedIdentityAuthorizeCallback implements ExtendedCallback {
     private IdentityCache createDomainCache() {
         return this.identityCache.apply(securityDomain);
     }
+
+    private static final class Roles implements Principal {
+
+        private String name;
+
+        private Roles(String name) {
+            this.name = name;
+        }
+
+        @Override
+        public String getName() {
+            return name;
+        }
+
+        public static Roles of(String role) {
+            return new Roles(role);
+        }
+    }
 }
\ No newline at end of file
diff --git a/auth/server/base/src/main/java/org/wildfly/security/auth/server/RealmIdentity.java b/auth/server/base/src/main/java/org/wildfly/security/auth/server/RealmIdentity.java
index d75b04b67c..aabe31bb97 100644
--- a/auth/server/base/src/main/java/org/wildfly/security/auth/server/RealmIdentity.java
+++ b/auth/server/base/src/main/java/org/wildfly/security/auth/server/RealmIdentity.java
@@ -24,6 +24,8 @@ import java.security.Principal;
 import java.security.spec.AlgorithmParameterSpec;
 import java.util.function.Function;
 
+import javax.security.auth.Subject;
+
 import org.wildfly.common.Assert;
 import org.wildfly.security.auth.SupportLevel;
 import org.wildfly.security.auth.principal.AnonymousPrincipal;
@@ -55,6 +57,13 @@ public interface RealmIdentity {
      */
     Principal getRealmIdentityPrincipal();
 
+    default Subject getSubject() {
+        return null;
+    }
+
+    default void setSubject(Subject subject) {
+    }
+
     /**
      * @deprecated Transition method; remove before GA.
      */
diff --git a/auth/server/base/src/main/java/org/wildfly/security/auth/server/ServerAuthenticationContext.java b/auth/server/base/src/main/java/org/wildfly/security/auth/server/ServerAuthenticationContext.java
index 595017a398..436210c91f 100644
--- a/auth/server/base/src/main/java/org/wildfly/security/auth/server/ServerAuthenticationContext.java
+++ b/auth/server/base/src/main/java/org/wildfly/security/auth/server/ServerAuthenticationContext.java
@@ -1132,6 +1132,7 @@ public final class ServerAuthenticationContext implements AutoCloseable {
                         }
                         if (principal != null) {
                             setAuthenticationPrincipal(principal);
+                            authorizeCallback.setSubject(stateRef.get().getRealmIdentity());
                             if (authorize()) {
                                 authorizedIdentity = getAuthorizedIdentity();
                             }
