I am thinking this is a role context search problem. I have used the out of the box Login configuration. However, my implementation has the groups in another sub tree. I have set the roleCtxDN to that location: <module-option name="rolesCtxDN">ou=Security Groups,ou=Adomain Users,dc=adomain,dc=com</module-option> I am wondering how the the following is resolved then: <module-option name="roleFilter">(sAMAccountName={0})</module-option> The users (sAMAccountName) would not reside in this sub tree, I believe I need to filter some other way. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3975537#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...