Regarding the 403 error, it looks like you changed one of the portal properties. Under Page Error Handling, the "When access to the window is denied" case needs to have the action "Remove the resource from the page"; you have the action set to "Display the default error message." You can specify security constraints for instances in the portlet-instances.xml file. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4134018#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...