Jboss AS does cache login info: ie. if you try to login incorrectly once, then change the database directly to disable the user, then flick back to the browser and try to login again it will NOT tell you that the user has been disabled. To turn off user caching in JBoss AS, edit the jboss-service.xml file in JBOSS_HOME/server/default/conf Change the "DefaultCacheTimeout" from the default 1800 to 0 to disable the LoginUserModule cache. Hope this helps, Mat View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4243321#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...