Let me try to understand your configuration. You have a standalone Tomcat that hosts a portal application. In this application, you have a java class that calls a ejb in another standalone jboss. Am I correct so far ? If that is the case, then your call from Tomcat to Jboss ejb should be no different from a regular java class calling a secured ejb through jaas login. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4180425#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...