diff --git a/projects/cadcAccessControl-Server/src/ca/nrc/cadc/ac/server/web/users/LoginServlet.java b/projects/cadcAccessControl-Server/src/ca/nrc/cadc/ac/server/web/users/LoginServlet.java
index ea59ec4ffeda74026edfbac5542897dacedd53ba..01291c29ef8fe6fa60376f8a63ca26fc567a4883 100755
--- a/projects/cadcAccessControl-Server/src/ca/nrc/cadc/ac/server/web/users/LoginServlet.java
+++ b/projects/cadcAccessControl-Server/src/ca/nrc/cadc/ac/server/web/users/LoginServlet.java
@@ -89,6 +89,7 @@ import ca.nrc.cadc.ac.server.GroupDetailSelector;
 import ca.nrc.cadc.ac.server.UserPersistence;
 import ca.nrc.cadc.ac.server.ldap.LdapGroupPersistence;
 import ca.nrc.cadc.ac.server.ldap.LdapUserPersistence;
+import ca.nrc.cadc.auth.AuthenticatorImpl;
 import ca.nrc.cadc.auth.HttpPrincipal;
 import ca.nrc.cadc.auth.SSOCookieManager;
 import ca.nrc.cadc.log.ServletLogInfo;
@@ -228,9 +229,10 @@ public class LoginServlet extends HttpServlet
         final LdapGroupPersistence<HttpPrincipal> gp = 
                 getLdapGroupPersistence();
         
-        
+        AuthenticatorImpl ai = new AuthenticatorImpl();
         Subject proxySubject = new Subject();
         proxySubject.getPrincipals().add(new HttpPrincipal(proxyUser));
+        ai.augmentSubject(proxySubject);
         try
         {
             Subject.doAs(proxySubject, new PrivilegedExceptionAction<Object>()
@@ -238,6 +240,7 @@ public class LoginServlet extends HttpServlet
                 @Override
                 public Object run() throws Exception
                 {
+                    
                     if (gp.getGroups(new HttpPrincipal(proxyUser), Role.MEMBER,
                             proxyGroup).size() == 0)
                     {
@@ -253,6 +256,7 @@ public class LoginServlet extends HttpServlet
 
             Subject userSubject = new Subject();
             userSubject.getPrincipals().add(new HttpPrincipal(userID));
+            ai.augmentSubject(userSubject);
             Subject.doAs(userSubject, new PrivilegedExceptionAction<Object>()
             {
                 @Override
diff --git a/projects/cadcAccessControl-Server/src/ca/nrc/cadc/auth/AuthenticatorImpl.java b/projects/cadcAccessControl-Server/src/ca/nrc/cadc/auth/AuthenticatorImpl.java
index 1812fc7eaa9cc6704f2022fe4b3085fda9eb5a5e..e7b9cdf1998042fec80653a1adf462dafd600dbe 100644
--- a/projects/cadcAccessControl-Server/src/ca/nrc/cadc/auth/AuthenticatorImpl.java
+++ b/projects/cadcAccessControl-Server/src/ca/nrc/cadc/auth/AuthenticatorImpl.java
@@ -124,7 +124,7 @@ public class AuthenticatorImpl implements Authenticator
         return subject;
     }
 
-    protected void augmentSubject(final Subject subject)
+    public void augmentSubject(final Subject subject)
     {
 
         try
diff --git a/projects/cadcAccessControl-Server/test/src/ca/nrc/cadc/ac/server/web/users/UserLoginServletTest.java b/projects/cadcAccessControl-Server/test/src/ca/nrc/cadc/ac/server/web/users/UserLoginServletTest.java
index 99d060b3e263f60cd188283f0a8a39104de9f6f6..fd94de9af7cee137ea132aab057af2d23b820247 100644
--- a/projects/cadcAccessControl-Server/test/src/ca/nrc/cadc/ac/server/web/users/UserLoginServletTest.java
+++ b/projects/cadcAccessControl-Server/test/src/ca/nrc/cadc/ac/server/web/users/UserLoginServletTest.java
@@ -37,7 +37,10 @@ public class UserLoginServletTest
                 proxyGroups.add(new Group(proxyGroup));
                 Collection<Group> niGroups = new HashSet<Group>();
                 niGroups.add(new Group(nonImpersonGroup));
-                LdapGroupPersistence<HttpPrincipal> mockGp = EasyMock
+                // mock returns a shell instance
+                @SuppressWarnings("unchecked")
+                LdapGroupPersistence<HttpPrincipal> mockGp = 
+                    (LdapGroupPersistence<HttpPrincipal>)EasyMock
                         .createMock(LdapGroupPersistence.class);
                 mockGp.setDetailSelector(new GroupDetailSelector()
                 {