Hello, Wolfgang, thanks again for your help. First of all, I must say that it is not *my* login module, that is, I have not written the application, nor I have access to the people who wrote it. I am only migrating it from oc4j. Once said that, the login module is not a subclass of the module you said, but a class that doesn't extends anyother, and implements LoginModule. I'm quite confused with the security-domain thing. I thought it was necessary if applied to EJB. I'll try to do a bit more research before tonight. Pablo J. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4060849#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...