Are you sure this login configuration is being used for authenticating? Are you doing a programatic login or container managed login? If you are using container managed login, have you configured the security-domain in the jboss-web.xml? What do the TRACE level logs from security package, show? See Q4 at http://wiki.jboss.org/wiki/Wiki.jsp?page=SecurityFAQ to enable TRACE level logs. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4126039#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...