We need this code both when we're running standalone and in the AS. I suggest the best thing to do here is to separate it the security code into its own jar, then the AS can depend on that, and we can then depend on that. This means we don't have to depend on the whole AS and the code is in one place. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4042317#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...