The login module is loaded by the JDK. Afair, the tccl should be set to the class loader that can load the LM class before jaas kicks in. In your example, the LM class resides in the ejb3 jar inside an ear. Need to see what the tccl is for the jaas framework. One of the odd places in AS7 where tccl becomes important. :(