Abstract: Under Backend Application Session Management (“BASM”), a DBMS not only creates an application session but also the respective adjunct security context to which to attach the adjunct security context. The middle tier does not need to create the application session or its adjunct security context. Instead, the middle tier sends an end-user token that the middle tier piggybacks to database requests that are sent through database connections. The end-user token identifies an end user and has been authenticated by the middle tier. The generation of the end-user token is concomitant to the process of the middle tier authenticating the end user. The DBMS invokes a user-defined function to generate an adjunct security context. The user-defined function generates the adjunct security context based on the end-user token. Application developers can customize the user-defined function to customize backend security for their needs.