If i remember well. when the LdapExtLoginModule flag = "optional" the login will not fail as long as your next login module works to return the roles. Of course your next module's flag need to be 'required' If you really have to modify the ldap login module, just modify the LdapExtLoginModule's getRoleSets() method to return a dummy blank set. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4131317#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...