Am I wrong stating that EJBs defined in WEB-INF/classes do not inherit the security domain of the servlet container? -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com