The problem is solved after I added multi-threaded="true" in auth.conf. Taken from http://wiki.jboss.org/wiki/Wiki.jsp?page=ClientLoginModule anonymous wrote : | When the multi-threaded option is set to true, each login thread has its own principal and credential storage. This is useful in client environments where multiple user identities are active in separate threads. When true, each separate thread must perform its own login. When set to false the login identity and credentials are global variables that apply to all threads in the VM. The default for this option is false. | Does it mean that embedded Tomcat and standalone Tomcat handle the thread in different way (since I'm using the same code but got different result when I deployed them in diff environment)? regards, View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3975444#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...