Okay, I thought I would revisit this after updating to the current release. After spending a little time thinking about the problem, it seems to me that there is a fundamental flaw with having to define a default page. The default page should be optional, and if it is not specified, the user should be taken to the first page they have the authority to see. Having spent some time in the WebSphere world, this is how their portal product works. If we are going to secure(require login) every page, and not every user can see every page and there is no common page, why should I have to create some artificial default page just so my users don't see a 403 error page? Comments? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4096284#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...