What is your problem? I did not understand... It's look like ok for me. You can(maybe should) have multiples securtity constraints for diferent roles... Are something that doesn't work? One point: you write "http://localhost:8080/administrator" and probally you want to write "http://localhost:8080/YOUR_WEB_APP_NAME/administrator". Am I right? I have a working example and I can send it for you if you need. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3982441#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...