"shane.bryzak(a)jboss.com" wrote : Calling addRole() when you are not authenticated yet puts the roles into a temporary list. They only become real roles once authentication is complete, which is why calling hasRole() in the authenticator method returns false. That explains it! I did the log messages in another action and see that the user is indeed in the appropriate roles. Thanks! View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4061968#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...