(I hate replying to myself, but somehow the last couple of lines in my first post got clipped.) Like the authenticate-method the auto-login-method on successful login would set roles at identity and return true. That would spare me from configuring a page action for all pages. It would prevent the spurious "Please login. Welcome." messages. Also I would neither need to check for "already logged in" condition nor would I need to pass user data in a field from the checkLogin method to the authenticate method like I did above. What do you think? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4086380#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...