I have a case where the ear contains a jboss-app.xml but misses a jboss.xml. So when I ask the JBossAssemblyDescritorMetaData for the securityroles configured, it is returning null because the "SecurityRoleMetaData" is not merged. It is available in the ear metadata. What needs to be done here? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4109084#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...