Its all in the docs: http://docs.jboss.com/jbportal/v2.6.4/referenceGuide/html/authentication.... anonymous wrote : | It leverages the fact that in JAAS authentication process occurs in two phases. In first phase when login() method is invoked it always returns "true". Because of this behavior SynchronizingLoginModule should be always used with "optional" flag. More over it should be placed after the module we want to leverage as a source for synchronization and that module should have "required" flag set. required != requisite :) View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4145961#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...