I have found my problem with jboss-negotiation-toolkit. I was using the service host/server2.scigems.org(a)SCIGEMS.ORG. But after some debug in jvm, i have found that there was a token with HTTP/server2.scigems.org builded. After modifying login-config.xml to use HTTP/server2.scigems(a)SCIGEMS.ORG as service principal All is OK. So, it is a normal behaviour ? Must be the service principal be HTTP/... to be SPNEGO compatible? Thx. If HTTP is mandatory, i think it must be written in the documentation. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4221013#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...