My recommendation is to use a database login module. Then your app can change the passwords at any time by submitting an update request to the database. If you want to use properties file, you app could modify the users properties file to change the password. Hopefully the app server doesn't cache the passwords but you could easily check this manually before writing any code. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4237410#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...