anonymous wrote : What I don't understand is why there was a messaging-users.properties/messaging-roles.properties in server/deploy/jboss-messaging.sar at all. Yes.. the correct place is under /conf... When we had that hack in place (setting the ThreadContextClassLoader), The security would look for those files in our scoped classLoader. I'm glad we could get rid of this thing finally. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4028572#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...