Its always a little tricky. Ejb's if they are secured, then to call them you should first be jaas logged in...But if you call the ejb from a Login Module, without being logged in, you go into an indefinite loop...Its like a re-entrant call with ejb's...Situation is different if you have @PermitAll...technically it should let you through View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4125724#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...