anonymous wrote : This application that I'm developing doesn't have to have any security restrictions Questions I have are :- (1) If Security is not desired, then why bother. Most certainly you can have unsecured ejb's . This is absolutely ok. (2) If you do not provide any security restrictions by way of special elements entry into your web.xml and jboss-web.xml and ejb-jar.xml , then your application is unsecured. Jboss does nothing special in this case & allows access to any methods that you may call on your ejb's anonymous wrote : If not, what would be another place for me to do the logout from the WebAutentication facility? Again, do you need authentication ? Else don't bother View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4170353#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...