During the click on page three, the JACCPortalAuthorizationManager ckecks the permission of the potalNodes. Here I can see, that the return value of the statement is null and checkmermission delivers false for the nodes. Subject subject = (Subject)PolicyContext.getContext("javax.security.auth.Subject.container"); Behind this the login of another secutity domain performs and i think, it kicks of the current login user. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4201039#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...