Thanks Peter. Workaround 2 is my target too. Under the LDAP tree, find the right person with related information (department code, user class, ...etc). These information can be used as the role. The question is how to config. I show the setting of LDAP login module. I want to use the "departmentcode" as the role. How to set? Each applications have their own user profile. For my case, the first step is the password - basic authentication. Then, later on, centralized role checking is a long term task. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4233159#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...