Until the authenticate() method completes and the login process itself completes the user's roles are not assigned. Any that you add by calling Identity.addRole() are added to a temporary store and only added to the user's actual list of roles when the login process is 'committed'. As an aside. why do you have 'new String("some string")' in all your code? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4045459#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...