According to http://www.jboss.com/?module=bb&op=viewtopic&p=3882728 step by step, I can use jass on duke's bank. Here is my configuration.. conf\login-config.xml <application-policy name="dukesbank"> | <authentication> | <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" flag="required"> | <module-option name="usersProperties">props/users.properties</module-option> | <module-option name="rolesProperties">props/roles.properties</module-option> | <module-option name="unauthenticatedIdentity">anonymous</module-option> | </login-module> | </authentication> | </application-policy> web\jboss-web.xml | <jboss-web> | <security-domain>java:/jaas/dukesbank</security-domain> | ... | </jboss-web> I do nothing on jboss.xml. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4033917#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...