yes it is Login.jsp it was a typo for the slash in the name, saw it after I posted it. well as weird as it sounds login.jsp (note the lower case L) works and Login.jsp (the cap letter one) does not.. the lower case one without any security setting works ok.. I did see some verbiage online that someone else ran into some problem similar to this because of some conflict with root context having something similar..not sure how they got around it. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3996376#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...