The SecurityServerClient API could use some improvements:

Have a complete, symmetrical API across all the SOAPEntity types (Principal, Group, Role). This should include at least the following (examples for Principal only):
addPrincipal(SOAPPrincipal)
removePrincipal(SOAPPrincipal)
updatePrincipal(SOAPPrincipal)

Have the SecurityServerClient use Lists rather than Arrays when returning collections of SOAPEntities. Even if this is only outward-facing and handled as Arrays internally, that is fine. Failing that, a Util class would be nice for wrestling with arrays. See this thread for details.