JDBC Realm & Roles

[Nathan Coast]

Hi,

Is the user-role information obtained via a JDBCRealm stored against a session? 
If not, each attempt to access a secured resource must result in a hit on the 
database - surely this would be bad for performance.  The downside of storing 
the role info is that if a users role changes during a session, they will not 
obtain their updated role information until they next login.

Can anyone shed any light on this?

Thanks in advance
Nathan