I remember playing with something like this.. Semi-Simple: The other way around would be to configure the JMS (Destination Mngr)to protected by the same realm as JBCS. This way the user would have an authernticated, and have authorization to publish. More advanced: That I partially know( and there was some beer in the conversation) to configure the some realm hierarchy, and make the JMS accept JBCS realm authenticaed users. In both case I think this would be: - invasive and complex. - but still much more elegant than usernames/passwords all over config files. The main idea is that if you have access to the publish codebase why not use the JAAS that is already there vs trick with semi-secret passwords. + password maintance would be really painfull. Aron View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3961669#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...