I am also getting this problem and can confirm that it has been introduced in 2.0.0.CR2. On a failed login I get two calls to the my own authenticate method and subsequently (because I add a faces message in my authenticate method) I get my two messages plus the standard Login Failed message for a total of three messages on a failed login (when I really only want two). If I roll back to 2.0.0.BETA1 (and change nothing else) the problem goes away. Where is the JIRA for this. how do you find these things? Troy View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4102057#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...