Turns out the real workaround is quite simple. I hand-created a jar file consisting of only the classes in org.jboss.security in jbosssx-client.jar, and called it orgJbossSecurity.jar. I then add orgJbossSecurity.jar and jboss-client.jar to my client classpath, and hey presto, I can both log in as a fat client to my JAS hosted secure application and use my custom-JAAS secured queues on the standalone JBoss Messaging instance. This was required for the last step of the message processing pipeline. I imagine the same tactic will work if I upgrade my main application server to JBoss Messaging as well, so maybe I don't have to wait for JBoss 5 after all. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3978401#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...