Yes, the jboss authentication and the jbpm identity module are two separate solutions. In the starterkit they both refer to the same database. So if you change the jboss login to AD, that has not relation at all to the identity module. There have been some requests to have an ldap based identity module as well, but AD is ,with regard to the roles, another issue. So yes, you have to write your own. The JBoss Portal 2.6 has an ldap based identity module and combining that with jBPM would be an interesting solution. But... that should not require you to use the full portal. Maybe it should become a separate project but that is up to JBoss. I can only try to influence that to a small extend. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4050194#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...