Authentication operations are performed within a CORBA-compliant environment with client applications using the JAAS programming model. A client application obtains an interoperable object reference (IOR) for a target object on a remote server that is protected within a security domain. After the client application invokes the target object, an object request is generated, and a request-level interceptor obtains the IOR for the target object and extracts an identifier for the security domain from the IOR. If a credential for the security domain is not in the current execution context of the client application, i.e., the current JAAS subject in the JAAS programming model, then the request-level interceptor performs an authentication operation with the security domain on behalf of the client application, receives an authentication credential, and places the authentication credential into the execution context of the client application. The object request is further processed in association with the obtained credential.