I have it working. It's critical to use exactly the right format in jboss.xml. It must be: <security-domain>myDomain</security-domain> not anything with java:/jaas or anything like that. I wrote my own LoginModule from scratch and it works fine. Is there any reason why I shouldn't use my own LoginModule instead of subclassing some from JBoss? I figured out how to set up the Roles group and the CallerPrincipal group and all the values seem to get passed around correctly. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4008137#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...