The 'struggling' guy would be me ;-) The Realm configuration was a last minute addition just before the 4.1 release. I followed the Tomcat doc to get a separate Realm for the jbpm-console (by adding a config in /conf/catalina/localhost/jbpm-console), but that didn't work. I also tried to narrow the realm to the /jbpm-console path obnly in the config, but that didn't work either. So I picked the easy path... The realm configuration certainly needs a revision and I would appreciate any pointers in the right direction, since like I said I'm hitting a wall with the official tomcat doc. But I do want us to have a separate realm. To answer your initial question: what about adding a manager role + user with that role to JBPM4_ID_GROUP, USER, etc? View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4254351#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...