Hi First of all thank you for your fast response. But I have to state the following: For sure, we do have specified <security-role-ref> tags in the "portlet.xml" file of our "testportlet.war" portlet application. Otherwise the "isUserInRole()" question does not work at all. But nevertheless it is necessary to specify additionally the "real" role in the "web.xml" of the JACC context (in a <security-role> tag). You can verify this in a simple test. So your statement means that one can never deploy a portlet application as a complete package. It will be always necessary to adjust the "portal-server.war/WEB-INF/web.xml" and/or "portal-wsrp.sar/WEB-INF/web.xml" if your portlets use the "isUserInRole()" method. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4031894#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...