anonymous wrote : So, yes, user principle and Subject are being created at every request. | | So, is there a way I can do a IsUserInRole type check in the jsp's that this servlet dispatches to? I dont see a way, you will be able to do that. Even if the servlet dispatches to jsps, the request object will remain the same which means the request.isUserInRole method is going to return you false. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3981328#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...