anonymous wrote : Now at what point can I check request.isUserInRole("FullUser") after successful login? I guess, not until the next request is generated. anonymous wrote : I am trying this method right after successful login. But it is returning false? Try the following method after successful login: request.getRemoteUser(); I believe this will return you null which means that the request object hasnt yet been populated with the logged in user information. So until the next request object is generated, you will not have the logged in user information. BTW, why are you doing manual login? Any specific requirement? You could have gone for FORM based authentication which would have done the same - since i see your login module is not doing anything special. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3981204#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...