Baskar, After a password is changed, the user must be logged out of application (i.e. JBossSX cache flush). If your UI is web-based, this usually can occure by invalidating the web session. Is this step happening? You can verify what principals are in the cache via the jmx-console (mbean: jboss.security:service=JaasSecurityManager). cgriffith View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3962807#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...