Solved the problem. I've added the following in login-config.xml <module-option name="uidAttributeID">uniquemember</module-option> | <module-option name="searchScope">SUBTREE_SCOPE</module-option> | <module-option name="rolesCtxDN">ou=Groups,dc=company,dc=co,dc=uk</module-option> | <module-option name="matchOnUserDN">true</module-option> | <module-option name="roleAttributeID">cn</module-option> | <module-option name="roleAttributeIsDN">false</module-option> | And, changed the following role-name in web.xml to the 'actual' role name as in LDAP. JBoss is not mapping the roles names described in jboss-web.xml View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4113206#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...