Solved ! I thought that only the flag "loginOk" have to be set to false und the login-method habe to return false, therefore the authentication in whole fails. But you have to throw a LoginException, too !! The JAAS LoginContext class sets a variable addicted to this Exception for subsequent loginmodules, like the SynchronizingLoginModule. Puuhh View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4147006#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...