diff --git a/REALM-CONTEXT-SETUP.md b/REALM-CONTEXT-SETUP.md
index a131b90..a37fab9 100644
--- a/REALM-CONTEXT-SETUP.md
+++ b/REALM-CONTEXT-SETUP.md
@@ -92,6 +92,7 @@
            defaultRoles=""
            containerType="TomcatContext"
            realmClasspath=""
+           contextId="HOME"
             />
  </Context>
  ```
diff --git a/REALM-HOST-SETUP.md b/REALM-HOST-SETUP.md
index 96e9cf6..125de1c 100644
--- a/REALM-HOST-SETUP.md
+++ b/REALM-HOST-SETUP.md
@@ -157,6 +157,7 @@
 	 containerType="Tomcat7"
      realmClasspath="$FORTRESS_REALM_HOME/conf:$FORTRESS_REALM_HOME/impl/target/fortress-realm-impl-uber-[version].jar"
      defaultRoles=""
+     contextId="HOME"
 	/>
  ```
 
diff --git a/impl/pom.xml b/impl/pom.xml
index c9c28b6..1ff8598 100644
--- a/impl/pom.xml
+++ b/impl/pom.xml
@@ -52,6 +52,13 @@
       <artifactId>fortress-core</artifactId>
       <version>${fortress-core.version}</version>
     </dependency>
+
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-log4j12</artifactId>
+      <version>${slf4j.log4j12.version}</version>
+    </dependency>
+
   </dependencies>
 
   <build>
diff --git a/impl/src/main/java/org/apache/directory/fortress/realm/J2eePolicyMgr.java b/impl/src/main/java/org/apache/directory/fortress/realm/J2eePolicyMgr.java
index a3f1656..379edec 100644
--- a/impl/src/main/java/org/apache/directory/fortress/realm/J2eePolicyMgr.java
+++ b/impl/src/main/java/org/apache/directory/fortress/realm/J2eePolicyMgr.java
@@ -47,7 +47,6 @@
      */
     boolean authenticate( String userId, char[] password ) throws SecurityException;
 
-
     /**
      * Perform user authentication {@link User#password} and role activations.<br />
      * This method must be called once per user prior to calling other methods within this class.
@@ -105,7 +104,6 @@
      */
     TcPrincipal createSession( String userId, char[] password ) throws SecurityException;
 
-
     /**
      * Perform user authentication {@link User#password} and role activations.<br />
      * This method must be called once per user prior to calling other methods within this class.
@@ -164,7 +162,6 @@
      */
     TcPrincipal createSession( String userId, char[] password, List<String> roles ) throws SecurityException;
 
-
     /**
      * Perform user authentication {@link User#password} and role activations.<br />
      * This method must be called once per user prior to calling other methods within this class.
@@ -222,7 +219,6 @@
      */
     Session createSession( User user, boolean isTrusted ) throws SecurityException;
 
-
     /**
      * Determine if given Role is contained within User's Tomcat Principal object.  This method does not need to hit
      * the ldap server as the User's activated Roles are loaded into {@link TcPrincipal#setContext(java.util.HashMap)}
@@ -235,7 +231,6 @@
      */
     boolean hasRole( Principal principal, String roleName ) throws SecurityException;
 
-
     /**
      * Method reads Role entity from the role container in directory.
      *
@@ -246,7 +241,6 @@
      */
     Role readRole( String roleName ) throws SecurityException;
 
-
     /**
      * Search for Roles assigned to given User.
      *
@@ -258,7 +252,6 @@
      */
     List<String> searchRoles( String userId, int limit ) throws SecurityException;
 
-
     /**
      * Method returns matching User entity that is contained within the people container in the directory.
      *
@@ -269,7 +262,6 @@
      */
     User readUser( String userId ) throws SecurityException;
 
-
     /**
      * Return a list of type String of all users in the people container that match the userId field passed in User entity.
      * This method is used by the Websphere sentry component.  The max number of returned users may be set by the integer limit arg.
@@ -281,7 +273,6 @@
      */
     List<String> searchUsers( String userId, int limit ) throws SecurityException;
 
-
     /**
      * This function returns the set of users assigned to a given role. The function is valid if and
      * only if the role is a member of the ROLES data set.
@@ -296,7 +287,6 @@
      */
     List<String> assignedUsers( String roleName, int limit ) throws SecurityException;
 
-
     /**
      * This function returns the set of roles authorized for a given user. The function is valid if
      * and only if the user is a member of the USERS data set.
@@ -307,7 +297,6 @@
      */
     List<String> authorizedRoles( String userId ) throws SecurityException;
 
-
     /**
      * This utility method can deserialize java.security.Principal to Fortress RBAC session object.
      *
@@ -315,5 +304,13 @@
      * @return deserialization target object
      */
     Session deserialize( String str ) throws SecurityException;
-}
 
+    /**
+     * Use this method to set the tenant id onto function call into Fortress which allows segregation of data by customer.
+     * The contextId is used for multi-tenancy to isolate data sets within a particular sub-tree within DIT.
+     * Setting contextId into this object will render this class' implementer thread unsafe.
+     *
+     * @param contextId maps to sub-tree in DIT, for example ou=contextId, dc=jts, dc = com.
+     */
+    public void setContextId(String contextId);
+}
\ No newline at end of file
diff --git a/impl/src/main/java/org/apache/directory/fortress/realm/J2eePolicyMgrFactory.java b/impl/src/main/java/org/apache/directory/fortress/realm/J2eePolicyMgrFactory.java
index d75ae10..7799371 100644
--- a/impl/src/main/java/org/apache/directory/fortress/realm/J2eePolicyMgrFactory.java
+++ b/impl/src/main/java/org/apache/directory/fortress/realm/J2eePolicyMgrFactory.java
@@ -19,9 +19,15 @@
  */
 package org.apache.directory.fortress.realm;
 
-import org.apache.directory.fortress.core.util.Config;
+import org.apache.commons.lang.StringUtils;
+import org.apache.directory.fortress.core.*;
+import org.apache.directory.fortress.core.GlobalIds;
 import org.apache.directory.fortress.core.SecurityException;
-import org.apache.directory.fortress.core.GlobalErrIds;
+import org.apache.directory.fortress.core.impl.AdminMgrImpl;
+import org.apache.directory.fortress.core.rest.AdminMgrRestImpl;
+import org.apache.directory.fortress.core.util.ClassUtil;
+import org.apache.directory.fortress.core.util.Config;
+import org.apache.directory.fortress.core.util.VUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -51,43 +57,42 @@
     private static String j2eeClassName = Config.getInstance().getProperty( J2EE_POLICYMGR_IMPLEMENTATION );
 
     /**
-     * Create and return a reference to {@link J2eePolicyMgr} object.
+     * Create and return a reference to {@link J2eePolicyMgr} object with HOME context.
      *
      * @return instance of {@link J2eePolicyMgr}.
      * @throws org.apache.directory.fortress.core.SecurityException in the event of failure during instantiation.
      */
     public static J2eePolicyMgr createInstance() throws SecurityException
     {
-        J2eePolicyMgr realmMgr;
-        
-        try
-        {
-            if ( ( j2eeClassName == null ) || ( j2eeClassName.length() == 0 ) )
-            {
-                j2eeClassName = J2EE_POLICYMGR_DEFAULT_CLASS;
-                LOG.debug( "{}.createInstance [{}], not found.", CLS_NM, J2EE_POLICYMGR_IMPLEMENTATION );
-                LOG.debug( "{}.createInstance use default [{}], not found.", CLS_NM, J2EE_POLICYMGR_DEFAULT_CLASS );
-            }
-            
-            realmMgr = (J2eePolicyMgr) Class.forName( j2eeClassName ).newInstance();
-        }
-        catch ( ClassNotFoundException e )
-        {
-            String error = CLS_NM + ".createInstance caught java.lang.ClassNotFoundException=" + e;
-            throw new SecurityException( GlobalErrIds.FT_MGR_CLASS_NOT_FOUND, error, e );
-        }
-        catch ( InstantiationException e )
-        {
-            String error = CLS_NM + ".createInstance caught java.lang.InstantiationException=" + e;
-            throw new SecurityException( GlobalErrIds.FT_MGR_INST_EXCEPTION, error, e );
-        }
-        catch ( IllegalAccessException e )
-        {
-            String error = CLS_NM + ".createInstance caught java.lang.IllegalAccessException=" + e;
-            LOG.error( error );
-            throw new SecurityException( GlobalErrIds.FT_MGR_ILLEGAL_ACCESS, error, e );
-        }
-        
-        return realmMgr;
+        return createInstance( GlobalIds.HOME );
     }
+
+
+    /**
+     * Create and return a reference to {@link J2eePolicyMgr} object with HOME context.
+     *
+     * @param contextId maps to sub-tree in DIT, for example ou=contextId, dc=example, dc=com.
+     * @return instance of {@link J2eePolicyMgr}.
+     * @throws SecurityException in the event of failure during instantiation.
+     */
+    public static J2eePolicyMgr createInstance(String contextId)
+        throws SecurityException
+    {
+        VUtil.assertNotNull( contextId, GlobalErrIds.CONTEXT_NULL, CLS_NM + ".createInstance" );
+        String j2eeClassName = Config.getInstance().getProperty( J2EE_POLICYMGR_IMPLEMENTATION );
+        J2eePolicyMgr policyMgr;
+
+        if ( StringUtils.isEmpty( j2eeClassName ) )
+        {
+            policyMgr = new J2eePolicyMgrImpl( );
+        }
+        else
+        {
+            policyMgr = ( J2eePolicyMgr ) ClassUtil.createInstance( J2EE_POLICYMGR_DEFAULT_CLASS );
+        }
+
+        policyMgr.setContextId( contextId );
+        return policyMgr;
+    }
+
 }
\ No newline at end of file
diff --git a/impl/src/main/java/org/apache/directory/fortress/realm/J2eePolicyMgrImpl.java b/impl/src/main/java/org/apache/directory/fortress/realm/J2eePolicyMgrImpl.java
index b5ae44a..3c7429d 100644
--- a/impl/src/main/java/org/apache/directory/fortress/realm/J2eePolicyMgrImpl.java
+++ b/impl/src/main/java/org/apache/directory/fortress/realm/J2eePolicyMgrImpl.java
@@ -28,9 +28,11 @@
 import java.util.HashMap;
 import java.util.List;
 import java.security.Principal;
+import java.util.NoSuchElementException;
 import java.util.Set;
 
 import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang.StringUtils;
 import org.apache.directory.fortress.core.GlobalIds;
 import org.apache.directory.fortress.core.ReviewMgr;
 import org.apache.directory.fortress.core.ReviewMgrFactory;
@@ -46,9 +48,9 @@
 import org.slf4j.LoggerFactory;
 
 /**
- * This class is for components that use Websphere and Tomcat Container SPI's to provide
- * Java EE Security capabilities.  These APIs may be called by external programs as needed though the recommended
- * practice is to use Fortress Core APIs like {@link org.apache.directory.fortress.core.AccessMgr} and {@link org.apache.directory.fortress.core.ReviewMgr}.
+ * This class contains common functions for container managed security.  These APIs may be called by external programs as needed though the expected
+ * practice for external app usage  is to call Apache Fortress Core APIs, e.g. {@link org.apache.directory.fortress.core.AccessMgr} and {@link org.apache.directory.fortress.core.ReviewMgr}.
+ * This class is NOT thread safe if contextId is set.
  *
  * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
  */
@@ -56,17 +58,18 @@
 {
     private static final String CLS_NM = J2eePolicyMgrImpl.class.getName();
     private static final Logger LOG = LoggerFactory.getLogger( CLS_NM );
-    private static AccessMgr accessMgr;
-    private static ReviewMgr reviewMgr;
+    private AccessMgr accessMgr;
+    private ReviewMgr reviewMgr;
     private static final String SESSION = "session";
+    private String contextId;
 
-    static
+    J2eePolicyMgrImpl ()
     {
         try
         {
-            accessMgr = AccessMgrFactory.createInstance( GlobalIds.HOME );
-            reviewMgr = ReviewMgrFactory.createInstance( GlobalIds.HOME );
-            LOG.info( "{} - Initialized successfully", CLS_NM );
+            accessMgr = AccessMgrFactory.createInstance( );
+            reviewMgr = ReviewMgrFactory.createInstance( );
+            LOG.info( "{} - constructed", CLS_NM );
         }
         catch ( SecurityException se )
         {
@@ -74,15 +77,8 @@
         }
     }
 
-
     /**
-     * Perform user authentication and evaluate password policies.
-     *
-     * @param userId   Contains the userid of the user signing on.
-     * @param password Contains the user's password.
-     * @return boolean true if succeeds, false otherwise.
-     * @throws org.apache.directory.fortress.core.SecurityException
-     *          in the event of data validation failure, security policy violation or DAO error.
+     * {@inheritDoc}
      */
     @Override
     public boolean authenticate( String userId, char[] password ) throws SecurityException
@@ -103,74 +99,8 @@
         return result;
     }
 
-
     /**
-     * Perform user authentication {@link org.apache.directory.fortress.core.model.User#password} and role activations.<br />
-     * This method must be called once per user prior to calling other methods within this class.
-     * The successful result is {@link org.apache.directory.fortress.core.model.Session} that contains target user's RBAC {@link
-     * User#roles} and Admin role {@link User#adminRoles}.<br />
-     * In addition to checking user password validity it will apply configured password policy checks {@link org.openldap
-     * .fortress.rbac.User#pwPolicy}..<br />
-     * Method may also store parms passed in for audit trail {@link org.apache.directory.fortress.core.model.FortEntity}.
-     * <h4> This API will...</h4>
-     * <ul>
-     * <li> authenticate user password if trusted == false.
-     * <li> perform <a href="http://www.openldap.org/">OpenLDAP</a> <a href="http://tools.ietf
-     * .org/html/draft-behera-ldap-password-policy-10/">password policy evaluation</a>.
-     * <li> fail for any user who is locked by OpenLDAP's policies {@link org.apache.directory.fortress.core.model.User#isLocked()},
-     * regardless of trusted flag being set as parm on API.
-     * <li> evaluate temporal {@link org.apache.directory.fortress.core.model.Constraint}(s) on {@link org.apache.directory.fortress.core.model.User},
-     * {@link org.apache.directory.fortress.core.model.UserRole} and {@link org.apache.directory.fortress.core.model.UserAdminRole} entities.
-     * <li> process selective role activations into User RBAC Session {@link User#roles}.
-     * <li> check Dynamic Separation of Duties {@link org.apache.directory.fortress.core.impl.DSDChecker)} on {@link org.apache.directory.fortress.core.model.User#roles}.
-     * <li> process selective administrative role activations {@link User#adminRoles}.
-     * <li> return a {@link org.apache.directory.fortress.core.model.Session} containing {@link org.apache.directory.fortress.core.model.Session#getUser()},
-     * {@link org.apache.directory.fortress.core.model.Session#getRoles()} and {@link org.apache.directory.fortress.core.model.Session#getAdminRoles()} if
-     * everything checks out good.
-     * <li> throw a checked exception that will be {@link org.apache.directory.fortress.core.SecurityException} or its derivation.
-     * <li> throw a {@link SecurityException} for system failures.
-     * <li> throw a {@link org.apache.directory.fortress.core.PasswordException} for authentication and password policy violations.
-     * <li> throw a {@link org.apache.directory.fortress.core.ValidationException} for data validation errors.
-     * <li> throw a {@link org.apache.directory.fortress.core.FinderException} if User id not found.
-     * </ul>
-     * <h4>
-     * The function is valid if and only if:
-     * </h4>
-     * <ul>
-     * <li> the user is a member of the USERS data set
-     * <li> the password is supplied (unless trusted).
-     * <li> the (optional) active role set is a subset of the roles authorized for that user.
-     * </ul>
-     * <h4>
-     * The following attributes may be set when calling this method
-     * </h4>
-     * <ul>
-     * <li> {@link org.apache.directory.fortress.core.model.User#userId} - required
-     * <li> {@link org.apache.directory.fortress.core.model.User#password}
-     * <li> {@link org.apache.directory.fortress.core.model.User#roles} contains a list of RBAC role names authorized for user and
-     * targeted for activation within this session.  Default is all authorized RBAC roles will be activated into this
-     * Session.
-     * <li> {@link org.apache.directory.fortress.core.model.User#adminRoles} contains a list of Admin role names authorized for user and
-     * targeted for activation.  Default is all authorized ARBAC roles will be activated into this Session.
-     * <li> {@link User#props} collection of name value pairs collected on behalf of User during signon.  For example
-     * hostname:myservername or ip:192.168.1.99
-     * </ul>
-     * <h4>
-     * Notes:
-     * </h4>
-     * <ul>
-     * <li> roles that violate Dynamic Separation of Duty Relationships will not be activated into session.
-     * <li> role activations will proceed in same order as supplied to User entity setter,
-     * see {@link org.apache.directory.fortress.core.model.User#setRole}.
-     * </ul>
-     * </p>
-     *
-     * @param userId   maps to {@link org.apache.directory.fortress.core.model.User#userId}.
-     * @param password maps to {@link org.apache.directory.fortress.core.model.User#password}.
-     * @return TcPrincipal which contains the User's RBAC Session data formatted into a java.security.Principal that
-     * is used by Tomcat runtime.
-     * @throws org.apache.directory.fortress.core.SecurityException
-     *          in the event of data validation failure, security policy violation or DAO error.
+     * {@inheritDoc}
      */
     @Override
     public TcPrincipal createSession( String userId, char[] password ) throws SecurityException
@@ -180,62 +110,8 @@
         return createSession( user );
     }
 
-
     /**
-     * Perform user authentication {@link User#password} and role activations.<br />
-     * This method must be called once per user prior to calling other methods within this class.
-     * The successful result is {@link org.apache.directory.fortress.core.model.Session} that contains target user's RBAC {@link User#roles} and Admin role {@link User#adminRoles}.<br />
-     * In addition to checking user password validity it will apply configured password policy checks {@link org.apache.directory.fortress.core.model.User#pwPolicy}..<br />
-     * Method may also store parms passed in for audit trail {@link org.apache.directory.fortress.core.model.FortEntity}.
-     * <h4> This API will...</h4>
-     * <ul>
-     * <li> authenticate user password if trusted == false.
-     * <li> perform <a href="http://www.openldap.org/">OpenLDAP</a> <a href="http://tools.ietf.org/html/draft-behera-ldap-password-policy-10/">password policy evaluation</a>.
-     * <li> fail for any user who is locked by OpenLDAP's policies {@link org.apache.directory.fortress.core.model.User#isLocked()}, regardless of trusted flag being set as parm on API.
-     * <li> evaluate temporal {@link org.apache.directory.fortress.core.model.Constraint}(s) on {@link User}, {@link org.apache.directory.fortress.core.model.UserRole} and {@link org.apache.directory.fortress.core.model.UserAdminRole} entities.
-     * <li> process selective role activations into User RBAC Session {@link User#roles}.
-     * <li> check Dynamic Separation of Duties {@link org.apache.directory.fortress.core.impl.DSDChecker} on {@link org.apache.directory.fortress.core.model.User#roles}.
-     * <li> process selective administrative role activations {@link User#adminRoles}.
-     * <li> return a {@link org.apache.directory.fortress.core.model.Session} containing {@link org.apache.directory.fortress.core.model.Session#getUser()}, {@link org.apache.directory.fortress.core.model.Session#getRoles()} and {@link org.apache.directory.fortress.core.model.Session#getAdminRoles()} if everything checks out good.
-     * <li> throw a checked exception that will be {@link org.apache.directory.fortress.core.SecurityException} or its derivation.
-     * <li> throw a {@link SecurityException} for system failures.
-     * <li> throw a {@link org.apache.directory.fortress.core.PasswordException} for authentication and password policy violations.
-     * <li> throw a {@link org.apache.directory.fortress.core.ValidationException} for data validation errors.
-     * <li> throw a {@link org.apache.directory.fortress.core.FinderException} if User id not found.
-     * </ul>
-     * <h4>
-     * The function is valid if and only if:
-     * </h4>
-     * <ul>
-     * <li> the user is a member of the USERS data set
-     * <li> the password is supplied (unless trusted).
-     * <li> the (optional) active role set is a subset of the roles authorized for that user.
-     * </ul>
-     * <h4>
-     * The following attributes may be set when calling this method
-     * </h4>
-     * <ul>
-     * <li> {@link User#userId} - required
-     * <li> {@link org.apache.directory.fortress.core.model.User#password}
-     * <li> {@link org.apache.directory.fortress.core.model.User#roles} contains a list of RBAC role names authorized for user and targeted for activation within this session.  Default is all authorized RBAC roles will be activated into this Session.
-     * <li> {@link org.apache.directory.fortress.core.model.User#adminRoles} contains a list of Admin role names authorized for user and targeted for activation.  Default is all authorized ARBAC roles will be activated into this Session.
-     * <li> {@link User#props} collection of name value pairs collected on behalf of User during signon.  For example hostname:myservername or ip:192.168.1.99
-     * </ul>
-     * <h4>
-     * Notes:
-     * </h4>
-     * <ul>
-     * <li> roles that violate Dynamic Separation of Duty Relationships will not be activated into session.
-     * <li> role activations will proceed in same order as supplied to User entity setter, see {@link org.apache.directory.fortress.core.model.User#setRole}.
-     * </ul>
-     * </p>
-     *
-     * @param userId   maps to {@link org.apache.directory.fortress.core.model.User#userId}.
-     * @param password maps to {@link org.apache.directory.fortress.core.model.User#password}.
-     * @param roles constains list of role names to activate.
-     * @return TcPrincipal which contains the User's RBAC Session data formatted into a java.security.Principal that is used by Tomcat runtime.
-     * @throws org.apache.directory.fortress.core.SecurityException
-     *          in the event of data validation failure, security policy violation or DAO error.
+     * {@inheritDoc}
      */
     public TcPrincipal createSession( String userId, char[] password, List<String> roles ) throws SecurityException
     {
@@ -253,13 +129,8 @@
         return createSession( user );
     }
 
-
     /**
-     * Utility function to call Fortress createSession, build the principal on behalf of caller.
-     *
-     * @param user
-     * @return
-     * @throws SecurityException
+     * {@inheritDoc}
      */
     private TcPrincipal createSession( User user ) throws SecurityException
     {
@@ -280,78 +151,7 @@
     }
 
     /**
-     * Perform user authentication {@link org.apache.directory.fortress.core.model.User#password} and role activations.<br />
-     * This method must be called once per user prior to calling other methods within this class.
-     * The successful result is {@link org.apache.directory.fortress.core.model.Session} that contains target user's RBAC {@link
-     * User#roles} and Admin role {@link User#adminRoles}.<br />
-     * In addition to checking user password validity it will apply configured password policy checks {@link org.openldap
-     * .fortress.rbac.User#pwPolicy}..<br />
-     * Method may also store parms passed in for audit trail {@link org.apache.directory.fortress.core.model.FortEntity}.
-     * <h4> This API will...</h4>
-     * <ul>
-     * <li> authenticate user password if trusted == false.
-     * <li> perform <a href="http://www.openldap.org/">OpenLDAP</a> <a href="http://tools.ietf
-     * .org/html/draft-behera-ldap-password-policy-10/">password policy evaluation</a>.
-     * <li> fail for any user who is locked by OpenLDAP's policies {@link org.apache.directory.fortress.core.model.User#isLocked()},
-     * regardless of trusted flag being set as parm on API.
-     * <li> evaluate temporal {@link org.apache.directory.fortress.core.model.Constraint}(s) on {@link org.apache.directory.fortress.core.model.User},
-     * {@link org.apache.directory.fortress.core.model.UserRole} and {@link org.apache.directory.fortress.core.model.UserAdminRole} entities.
-     * <li> process selective role activations into User RBAC Session {@link User#roles}.
-     * <li> check Dynamic Separation of Duties {@link org.apache.directory.fortress.core.impl.DSDChecker} on {@link org.apache.directory.fortress.core
-     * .rbac.User#roles}.
-     * <li> process selective administrative role activations {@link User#adminRoles}.
-     * <li> return a {@link org.apache.directory.fortress.core.model.Session} containing {@link org.apache.directory.fortress.core.model.Session#getUser()},
-     * {@link org.apache.directory.fortress.core.model.Session#getRoles()} and {@link org.apache.directory.fortress.core.model.Session#getAdminRoles()} if
-     * everything checks out good.
-     * <li> throw a checked exception that will be {@link org.apache.directory.fortress.core.SecurityException} or its derivation.
-     * <li> throw a {@link SecurityException} for system failures.
-     * <li> throw a {@link org.apache.directory.fortress.core.PasswordException} for authentication and password policy violations.
-     * <li> throw a {@link org.apache.directory.fortress.core.ValidationException} for data validation errors.
-     * <li> throw a {@link org.apache.directory.fortress.core.FinderException} if User id not found.
-     * </ul>
-     * <h4>
-     * The function is valid if and only if:
-     * </h4>
-     * <ul>
-     * <li> the user is a member of the USERS data set
-     * <li> the password is supplied (unless trusted).
-     * <li> the (optional) active role set is a subset of the roles authorized for that user.
-     * </ul>
-     * <h4>
-     * The following attributes may be set when calling this method
-     * </h4>
-     * <ul>
-     * <li> {@link org.apache.directory.fortress.core.model.User#userId} - required
-     * <li> {@link org.apache.directory.fortress.core.model.User#password}
-     * <li> {@link org.apache.directory.fortress.core.model.User#roles} contains a list of RBAC role names authorized for user and
-     * targeted for activation within this session.  Default is all authorized RBAC roles will be activated into this
-     * Session.
-     * <li> {@link org.apache.directory.fortress.core.model.User#adminRoles} contains a list of Admin role names authorized for user and
-     * targeted for activation.  Default is all authorized ARBAC roles will be activated into this Session.
-     * <li> {@link org.apache.directory.fortress.core.model.User#props} collection of name value pairs collected on behalf of User during
-     * signon.  For example hostname:myservername or ip:192.168.1.99
-     * </ul>
-     * <h4>
-     * Notes:
-     * </h4>
-     * <ul>
-     * <li> roles that violate Dynamic Separation of Duty Relationships will not be activated into session.
-     * <li> role activations will proceed in same order as supplied to User entity setter,
-     * see {@link org.apache.directory.fortress.core.model.User#setRole}.
-     * </ul>
-     * </p>
-     *
-     * @param user      Contains {@link org.apache.directory.fortress.core.model.User#userId}, {@link org.apache.directory.fortress.core.model.User#password}
-     *                  (optional if {@code isTrusted} is 'true'), optional {@link org.apache.directory.fortress.core.model.User#roles},
-     *                  optional {@link org.apache.directory.fortress.core.model.User#adminRoles}
-     * @param isTrusted if true password is not required.
-     * @return Session object will contain authentication result code {@link org.apache.directory.fortress.core.model.Session#errorId},
-     * RBAC role activations {@link org.apache.directory.fortress.core.model.Session#getRoles()}, Admin Role activations {@link org.openldap
-     * .fortress.rbac.Session#getAdminRoles()},OpenLDAP pw policy codes {@link org.apache.directory.fortress.core.model
-     * .Session#warningId}, {@link org.apache.directory.fortress.core.model.Session#expirationSeconds},
-     * {@link org.apache.directory.fortress.core.model.Session#graceLogins} and more.
-     * @throws org.apache.directory.fortress.core.SecurityException
-     *          in the event of data validation failure, security policy violation or DAO error.
+     * {@inheritDoc}
      */
     @Override
     public Session createSession( User user, boolean isTrusted ) throws SecurityException
@@ -361,17 +161,8 @@
         return accessMgr.createSession( user, isTrusted );
     }
 
-
     /**
-     * Determine if given Role is contained within User's Tomcat Principal object.  This method does not need to hit
-     * the ldap server as the User's activated Roles are loaded into {@link org.apache.directory.fortress.realm.tomcat
-     * .TcPrincipal#setContext(java.util.HashMap)}
-     *
-     * @param principal Contains User's Tomcat RBAC Session data that includes activated Roles.
-     * @param roleName  Maps to {@link org.apache.directory.fortress.core.model.Role#name}.
-     * @return True if Role is found in TcPrincipal, false otherwise.
-     * @throws org.apache.directory.fortress.core.SecurityException
-     *          data validation failure or system error..
+     * {@inheritDoc}
      */
     @Override
     public boolean hasRole( Principal principal, String roleName ) throws SecurityException
@@ -416,14 +207,8 @@
         return result;
     }
 
-
     /**
-     * Method reads Role entity from the role container in directory.
-     *
-     * @param roleName maps to {@link org.apache.directory.fortress.core.model.Role#name}, to be read.
-     * @return Role entity that corresponds with role name.
-     * @throws org.apache.directory.fortress.core.SecurityException
-     *          will be thrown if role not found or system error occurs.
+     * {@inheritDoc}
      */
     @Override
     public Role readRole( String roleName ) throws SecurityException
@@ -431,31 +216,17 @@
         return reviewMgr.readRole( new Role( roleName ) );
     }
 
-
     /**
-     * Search for Roles assigned to given User.
-     *
-     * @param searchString Maps to {@link org.apache.directory.fortress.core.model.User#userId}.
-     * @param limit        controls the size of ldap result set returned.
-     * @return List of type String containing the {@link org.apache.directory.fortress.core.model.Role#name} of all assigned Roles.
-     * @throws org.apache.directory.fortress.core.SecurityException
-     *          in the event of data validation failure or DAO error.
+     * {@inheritDoc}
      */
     @Override
-    public List<String> searchRoles( String searchString, int limit ) throws SecurityException
+    public List<String> searchRoles(String searchString, int limit ) throws SecurityException
     {
         return reviewMgr.findRoles( searchString, limit );
     }
 
-
     /**
-     * Method returns matching User entity that is contained within the people container in the directory.
-     *
-     * @param userId maps to {@link org.apache.directory.fortress.core.model.User#userId} that matches record in the directory.  userId
-     *               is globally unique in
-     *               people container.
-     * @return entity containing matching user data.
-     * @throws SecurityException if record not found or system error occurs.
+     * {@inheritDoc}
      */
     @Override
     public User readUser( String userId ) throws SecurityException
@@ -463,36 +234,17 @@
         return reviewMgr.readUser( new User( userId ) );
     }
 
-
     /**
-     * Return a list of type String of all users in the people container that match the userId field passed in User
-     * entity.
-     * This method is used by the Websphere sentry component.  The max number of returned users may be set by the
-     * integer limit arg.
-     *
-     * @param searchString contains all or some leading chars that correspond to users stored in the directory.
-     * @param limit        integer value sets the max returned records.
-     * @return List of type String containing matching userIds.
-     * @throws SecurityException in the event of system error.
+     * {@inheritDoc}
      */
     @Override
-    public List<String> searchUsers( String searchString, int limit ) throws SecurityException
+    public List<String> searchUsers(String searchString, int limit ) throws SecurityException
     {
         return reviewMgr.findUsers( new User( searchString ), limit );
     }
 
-
     /**
-     * This function returns the set of users assigned to a given role. The function is valid if and
-     * only if the role is a member of the ROLES data set.
-     * The max number of users returned is constrained by limit argument.
-     * This method is used by the Websphere sentry component.  This method does NOT use hierarchical rbac.
-     *
-     * @param roleName maps to {@link org.apache.directory.fortress.core.model.Role#name} of Role entity assigned to user.
-     * @param limit    integer value sets the max returned records.
-     * @return List of type String containing userIds assigned to a particular role.
-     * @throws org.apache.directory.fortress.core.SecurityException
-     *          in the event of data validation or system error.
+     * {@inheritDoc}
      */
     @Override
     public List<String> assignedUsers( String roleName, int limit ) throws SecurityException
@@ -500,14 +252,8 @@
         return reviewMgr.assignedUsers( new Role( roleName ), limit );
     }
 
-
     /**
-     * This function returns the set of roles authorized for a given user. The function is valid if
-     * and only if the user is a member of the USERS data set.
-     *
-     * @param userId maps to {@link org.apache.directory.fortress.core.model.User#userId} matching User entity stored in the directory.
-     * @return Set of type String containing the roles assigned and roles inherited.
-     * @throws SecurityException If user not found or system error occurs.
+     * {@inheritDoc}
      */
     @Override
     public List<String> authorizedRoles( String userId ) throws SecurityException
@@ -527,7 +273,6 @@
         
         return list;
     }
-    
 
     /**
      * Utility to write any object into a Base64 string.  Used by this class to serialize {@link TcPrincipal} object to be returned by its toString method..
@@ -558,12 +303,8 @@
         return szRetVal;
     }
 
-
     /**
-     * This utility method deserializes java.security.Principal to Fortress RBAC session object.
-     *
-     * @param str contains String to deserialize
-     * @return deserialization target object
+     * {@inheritDoc}
      */
     public Session deserialize( String str ) throws SecurityException
     {
@@ -591,4 +332,15 @@
             throw new SecurityException( org.apache.directory.fortress.realm.GlobalIds.CONTEXT_DESERIALIZATION_FAILED_CLASS_NOT_FOUND, "deserialize caught ClassNotFoundException:" + e, e );
         }
     }
-}
+
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public final void setContextId(String contextId)
+    {
+        this.contextId = contextId;
+        accessMgr.setContextId( contextId );
+        reviewMgr.setContextId( contextId );
+    }
+}
\ No newline at end of file
diff --git a/impl/src/main/java/org/apache/directory/fortress/realm/tomcat/TC7AccessMgrFascade.java b/impl/src/main/java/org/apache/directory/fortress/realm/tomcat/TC7AccessMgrFascade.java
deleted file mode 100644
index 430e132..0000000
--- a/impl/src/main/java/org/apache/directory/fortress/realm/tomcat/TC7AccessMgrFascade.java
+++ /dev/null
@@ -1,241 +0,0 @@
-/*
- *   Licensed to the Apache Software Foundation (ASF) under one
- *   or more contributor license agreements.  See the NOTICE file
- *   distributed with this work for additional information
- *   regarding copyright ownership.  The ASF licenses this file
- *   to you under the Apache License, Version 2.0 (the
- *   "License"); you may not use this file except in compliance
- *   with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- *   Unless required by applicable law or agreed to in writing,
- *   software distributed under the License is distributed on an
- *   "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- *   KIND, either express or implied.  See the License for the
- *   specific language governing permissions and limitations
- *   under the License.
- *
- */
-package org.apache.directory.fortress.realm.tomcat;
-
-import org.apache.catalina.LifecycleException;
-import org.apache.catalina.Wrapper;
-import org.apache.catalina.realm.RealmBase;
-
-import java.security.Principal;
-import java.util.logging.Logger;
-
-/**
- * This class extends the Tomcat 7 and beyond RealmBase class and provides Java EE security services within the Tomcat container.
- * This class is a "proxy" for the {@link org.apache.directory.fortress.realm.tomcat.TcAccessMgrImpl} class which isolates dependencies from the Tomcat
- * runtime environment by loading the implementation on a URLClassLoader.
- *
- * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
- */
-public class TC7AccessMgrFascade extends RealmBase
-{
-    private static final String CLS_NM = TC7AccessMgrFascade.class.getName();
-    private static final Logger LOG = Logger.getLogger( CLS_NM );
-    private static final String REALM_IMPL = "org.apache.directory.fortress.realm.tomcat.TcAccessMgrImpl";
-    private static final String REALM_CLASSPATH = "REALM_CLASSPATH";
-    private static final String JBOSS_AGENT = "jboss";
-    private String container = "Catalina7";
-    private String defaultRoles;
-    private String realmClasspath;
-    private TcAccessMgr realm = new TcAccessMgrImpl();
-
-    /**
-     * Gets the info attribute of the TcAccessMgrProxy object
-     *
-     * @return The info value
-     */
-    @Override
-    public String getInfo()
-    {
-        return info;
-    }
-
-
-    /**
-     * Perform user authentication and evaluate password policies.
-     *
-     * @param userId   Contains the userid of the user signing on.
-     * @param password Contains the user's password.
-     * @return Principal whic     * This method will load the Fortress Tomcat implementation on a URL classloader.  Methods on the implementation are
-     * wrapped by methods on this class and are accessed via the {@code realm} instance variable of this class.
-     */
-    @Override
-    public Principal authenticate( String userId, String password )
-    {
-        if ( realm == null )
-        {
-            throw new RuntimeException( CLS_NM + "authenticate detected Fortress Tomcat7 Realm not initialized correctly.  Check your Fortress Realm configuration" );
-        }
-        
-        return realm.authenticate( userId, password.toCharArray()) ;
-    }
-
-
-    /**
-     * Determine if given Role is contained within User's Tomcat Principal object.  This method does not need to hit
-     * the ldap server as the User's activated Roles are loaded into {@link org.apache.directory.fortress.realm.TcPrincipal#setContext(java.util.HashMap)}
-     *
-     * @param principal Contains User's Tomcat RBAC Session data that includes activated Roles.
-     * @param role  Maps to {@code org.apache.directory.fortress.core.model.Role#name}.
-     * @return True if Role is found in TcPrincipal, false otherwise.
-     */
-    @Override
-    public boolean hasRole( Wrapper wrapper, Principal principal, String role )
-    {
-        if ( realm == null )
-        {
-            throw new RuntimeException( CLS_NM + "authenticate detected Fortress Tomcat7 Realm not initialized correctly.  Check your Fortress Realm configuration" );
-        }
-        
-        return realm.hasRole( principal, role );
-    }
-    
-
-    /**
-     * Gets the name attribute of the TcAccessMgrProxy object
-     *
-     * @return The name value
-     */
-    @Override
-    protected String getName()
-    {
-        return ( CLS_NM );
-    }
-
-
-    /**
-     * Gets the password attribute of the TcAccessMgrProxy object
-     *
-     * @param username Description of the Parameter
-     * @return The password value
-     */
-    @Override
-    protected String getPassword( String username )
-    {
-        return null;
-    }
-
-
-    /**
-     * Gets the principal attribute of the TcAccessMgrProxy object
-     *
-     * @param username Description of the Parameter
-     * @return The principal value
-     */
-    @Override
-    protected Principal getPrincipal( String username )
-    {
-        return null;
-    }
-
-
-    /**
-     * Prepare for the beginning of active use of the public methods of this
-     * component and implement the requirements of
-     * {@link org.apache.catalina.util.LifecycleBase#startInternal()}.
-     *
-     * @throws LifecycleException if this component detects a fatal error
-     *                            that prevents this component from being used
-     */
-    @Override
-    protected void startInternal() throws LifecycleException
-    {
-        super.startInternal();
-    }
-
-    
-    /**
-     * Gracefully terminate the active use of the public methods of this
-     * component and implement the requirements of
-     * {@link org.apache.catalina.util.LifecycleBase#stopInternal()}.
-     *
-     * @throws LifecycleException if this component detects a fatal error
-     *                            that needs to be reported
-     */
-    @Override
-    protected void stopInternal() throws LifecycleException
-    {
-
-        // Perform normal superclass finalization
-        super.stopInternal();
-
-        // Release reference to our sentry impl
-        realm = null;
-
-    }
-
-    
-    /**
-     * Gets the containerType attribute of the TcAccessMgrProxy object
-     *
-     * @return The containerType value
-     */
-    public String getContainerType()
-    {
-        return container;
-    }
-
-    
-    /**
-     * Sets the containerType attribute of the TcAccessMgrProxy object
-     *
-     * @param container The new containerType value
-     */
-    public void setContainerType( String container )
-    {
-        LOG.info( CLS_NM + ".setContainerType <" + container + ">" );
-        this.container = container;
-    }
-    
-
-    /**
-     * Gets the realmClasspath attribute of the TcAccessMgrProxy object
-     *
-     * @return The realmClasspath value
-     */
-    public String getRealmClasspath()
-    {
-        LOG.info( CLS_NM + ".getRealmClasspath <" + realmClasspath + ">" );
-        return realmClasspath;
-    }
-    
-
-    /**
-     * Sets the realmClasspath attribute of the TcAccessMgrProxy object
-     *
-     * @param rCpth The new realmClasspath value
-     */
-    public void setRealmClasspath( String rCpth )
-    {
-        LOG.info( CLS_NM + ".setRealmClasspath <" + rCpth + ">" );
-        this.realmClasspath = rCpth;
-    }
-
-    /**
-     * Gets the defaultRoles attribute of the TcAccessMgrProxy object.  When set, it will be passed into all subsequent calls to Fortress createSession.
-     *
-     * @return String containing comma delimited list of role names.
-     */
-    public String getDefaultRoles()
-    {
-        LOG.info( CLS_NM + ".getDefaultRoles <" + defaultRoles + ">" );
-        return defaultRoles;
-    }
-
-    /**
-     * Sets the defaultRoles attribute of the TcAccessMgrProxy object.  When set, it will be passed into all subsequent calls to Fortress createSession.
-     *
-     * @param defaultRoles containing comma delimited list of role names.
-     */
-    public void setDefaultRoles( String defaultRoles )
-    {
-        LOG.info( CLS_NM + ".setDefaultRoles <" + defaultRoles + ">"  );
-        this.defaultRoles = defaultRoles;
-    }
-}
\ No newline at end of file
diff --git a/impl/src/main/java/org/apache/directory/fortress/realm/tomcat/TcAccessMgrImpl.java b/impl/src/main/java/org/apache/directory/fortress/realm/tomcat/TcAccessMgrImpl.java
index 1fab25c..6f260a7 100644
--- a/impl/src/main/java/org/apache/directory/fortress/realm/tomcat/TcAccessMgrImpl.java
+++ b/impl/src/main/java/org/apache/directory/fortress/realm/tomcat/TcAccessMgrImpl.java
@@ -47,6 +47,7 @@
     private J2eePolicyMgr j2eeMgr;
     // If this field gets set, use for all subsequent calls to authenticate:
     private List<String> defaultRoles;
+    private String contextId;
 
     /**
      * Constructor for the TcAccessMgrImpl object
@@ -55,7 +56,7 @@
     {
         try
         {
-            j2eeMgr = J2eePolicyMgrFactory.createInstance();
+            j2eeMgr = J2eePolicyMgrFactory.createInstance( );
             LOG.info( "{} constructor <{}>", CLS_NM, incrementCtr() );
         }
         catch ( SecurityException se )
@@ -71,19 +72,17 @@
     {
         return count++;
     }
-    
+
 
     /**
-     * Perform user authentication and evaluate password policies.
-     *
-     * @param userId   Contains the userid of the user signing on.
-     * @param password Contains the user's password.
-     * @return Principal which contains the Fortress RBAC session data.
+     * {@inheritDoc}
      */
+    @Override
     public Principal authenticate( String userId, char[] password )
     {
         TcPrincipal principal = null;
-        
+
+        System.out.println("BREAK1");
         try
         {
             // If a 'default.roles' property set in config, user them
@@ -106,29 +105,28 @@
         return principal;
     }
 
-    
     /**
-     * Determine if given Role is contained within User's Tomcat Principal object.  This method does not need to hit
-     * the ldap server as the User's activated Roles are loaded into {@link TcPrincipal#setContext(java.util.HashMap)}
-     *
-     * @param principal Contains User's Tomcat RBAC Session data that includes activated Roles.
-     * @param roleName  Maps to {@code org.apache.directory.fortress.core.model.Role#name}.
-     * @return True if Role is found in TcPrincipal, false otherwise.
+     * {@inheritDoc}
      */
+    @Override
     public boolean hasRole( Principal principal, String roleName )
     {
         boolean result = false;
         String userId = principal.getName();
-        
+
+        System.out.println("BREAK2 user:" + userId + ", role" + roleName);
         try
         {
             if ( j2eeMgr.hasRole( principal, roleName ) )
             {
+                System.out.println("BREAK3 user:" + userId + ", role" + roleName);
+
                 LOG.debug( "{}.hasRole userId [{}], role[{}], successful", CLS_NM, principal.getName(), roleName );
                 result = true;
             }
             else
             {
+                System.out.println("BREAK4 user:" + userId + ", role" + roleName);
                 LOG.debug( "{}.hasRole userId [{}], role[{}], failed", CLS_NM, principal.getName(), roleName );
             }
         }
@@ -137,15 +135,14 @@
             LOG.warn( "{}.hasRole userId <{}> role <{}> caught SecurityException= {}", CLS_NM, userId, roleName, se);
         }
 
+        System.out.println("BREAK5 user:" + userId + ", role" + roleName);
         return result;
     }
 
     /**
-     * When the 'defaultRoles' parameter is set on realm proxy config (e.g. in server.xml or context.xml) it will be used to pass into
-     * createSession calls into Fortress.  This will scope the roles to be considered for activation to this particular set.
-     *
-     * @param szDefaultRoles contains a String containing comma delimited roles names.
+     * {@inheritDoc}
      */
+    @Override
     public void setDefaultRoles( String szDefaultRoles )
     {
         if( StringUtils.isNotEmpty( szDefaultRoles ) )
@@ -154,4 +151,15 @@
             LOG.info( "DEFAULT ROLES: {}", defaultRoles );
         }
     }
-}
+
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public void setContextId( String contextId )
+    {
+        this.contextId = contextId;
+        j2eeMgr.setContextId( contextId );
+        LOG.info( "CONTEXT ID: {}", contextId );
+    }
+}
\ No newline at end of file
diff --git a/proxy/src/main/java/org/apache/directory/fortress/realm/tomcat/Tc7AccessMgrProxy.java b/proxy/src/main/java/org/apache/directory/fortress/realm/tomcat/Tc7AccessMgrProxy.java
index 4c6ad05..0580f6a 100644
--- a/proxy/src/main/java/org/apache/directory/fortress/realm/tomcat/Tc7AccessMgrProxy.java
+++ b/proxy/src/main/java/org/apache/directory/fortress/realm/tomcat/Tc7AccessMgrProxy.java
@@ -41,13 +41,14 @@
 public class Tc7AccessMgrProxy extends RealmBase
 {
     private static final String CLS_NM = Tc7AccessMgrProxy.class.getName();
-    private static final Logger LOG = Logger.getLogger(CLS_NM);
+    private static final Logger LOG = Logger.getLogger( CLS_NM );
     private static final String REALM_IMPL = "org.apache.directory.fortress.realm.tomcat.TcAccessMgrImpl";
     private static final String REALM_CLASSPATH = "REALM_CLASSPATH";
     private static final String JBOSS_AGENT = "jboss";
     private String CONTAINER = "Catalina7";
     private String defaultRoles;
     private String realmClasspath;
+    private String contextId;
     private TcAccessMgr realm;
 
     /**
@@ -90,7 +91,8 @@
             Class<?> sc = ucl.loadClass( REALM_IMPL );
             realm = (TcAccessMgr) sc.newInstance();
             realm.setDefaultRoles( defaultRoles );
-            LOG.info( CLS_NM + " J2EE Tomcat7 policy agent initialization successful" );
+            realm.setContextId( contextId );
+            LOG.info( CLS_NM + " J2EE Tomcat7 policy agent, contextId: " + contextId + ", defaultRoles: " + defaultRoles );
         }
         catch ( ClassNotFoundException e )
         {
@@ -320,4 +322,26 @@
         LOG.info( CLS_NM + ".setDefaultRoles <" + defaultRoles + ">" );
         this.defaultRoles = defaultRoles;
     }
+
+    /**
+     * Gets the contextId attribute of the TcAccessMgrProxy object.  When set, it will be used as tenant id within the fortress manager apis.
+     *
+     * @return String containing comma delimited list of role names.
+     */
+    public String getContextId()
+    {
+        LOG.info( CLS_NM + ".getContextId <" + contextId + ">" );
+        return contextId;
+    }
+
+    /**
+     * Sets the contextId attribute of the TcAccessMgrProxy object.  When set, it will be used as tenant id within the fortress manager apis.
+     *
+     * @param contextId containing the id of instance.
+     */
+    public void setContextId(String contextId)
+    {
+        LOG.info( CLS_NM + ".setContextId <" + contextId + ">" );
+        this.contextId = contextId;
+    }
 }
\ No newline at end of file
diff --git a/proxy/src/main/java/org/apache/directory/fortress/realm/tomcat/TcAccessMgr.java b/proxy/src/main/java/org/apache/directory/fortress/realm/tomcat/TcAccessMgr.java
index 4f9d055..19da26e 100644
--- a/proxy/src/main/java/org/apache/directory/fortress/realm/tomcat/TcAccessMgr.java
+++ b/proxy/src/main/java/org/apache/directory/fortress/realm/tomcat/TcAccessMgr.java
@@ -57,4 +57,13 @@
      * @param roles contains a String containing comma delimited roles names.
      */
     void setDefaultRoles( String roles );
+
+
+    /**
+     * When the 'contextId' parameter is set on realm proxy config (e.g. in server.xml or context.xml) it will be used to pass into
+     * fortress core apis as tenantId.
+     *
+     * @param contextId contains a String containing the tenantId for the operations.
+     */
+    public void setContextId( String contextId );
 }
\ No newline at end of file