Hi, there are some differences. First of all, you need a jboss specific "Security Domain". For this, add a file "jboss-web.xml" to "WEB-INF" of your web project, declaring a "security-domain": <?xml version="1.0" encoding="UTF-8"?> | <!DOCTYPE jboss-web PUBLIC | "-//JBoss//DTD Web Application 4.2//EN" | "http://www.jboss.org/j2ee/dtd/jboss-web_4_2.dtd"> | | <jboss-web> | <security-domain>java:/jaas/nameofyoursecuritydomain</security-domain> | <context-root>...</context-root> | </jboss-web> The security domain itself is declared in "\server\default\conf\login-config.xml" and defines the user/role mappings. As I see that you are from Germany: here is a german tutorial for JBoss security (including a database-based user/role mapping): http://www.informatik.fh-wiesbaden.de/~knauf/SWTVertiefungWS2007/security... Hope this helps Wolfgang View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4190063#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...