Hi, "client.login" must be called only once. Please start a new thread, and provide us with more details on your login module and security configuration and on your client code. Did you check that your user is authenticated by the login module? Maybe the login fails and the login module falls back e.g. to the unauthenticatedIdentity (take a look at question 4 of the FAQ to see how to activate security layer logging). Best regards Wolfgang View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4221954#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...