Going by the number of people reporting this problem, i decided to test a sample application. Here's what i found: - It looks like the way you mention the security domain in the jboss.xml has changed. In earlier versions, you were supposed to specify something like: <jboss> | <security-domain>java:/jaas/jbossmq</security-domain> | </jboss> i.e the entire jndi name. However this version JBoss4.0.4 GA (i tried out only on this version), needs you to specify only the security domain name. Something like: <jboss> | <security-domain>jbossmq</security-domain> | </jboss> This worked for me(Replace the jbossmq with any other security domain name that you want to use and is defined in login-config.xml). I did not specify any SecurityDomain annotation in the bean and just added the above mentioned line in jboss.xml and it worked. So conclusion is, you can still use the jboss.xml without having to specify a annotation in the bean. Now i am not sure whether this is a bug in JBoss or whether this change in behavior was intentional but was missed out in the documentation. If any JBoss developer considers this as a bug, do let me know, i can provide the test case along with the logs that i have. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3976999#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...