2 issues here. Lets take the first one. You will have to change your login module to extend jboss AbstractServerLoginModule as follows :- anonymous wrote : Here is my LoginModule | | final public class DbLoginModuleImpl implements LoginModule { to anonymous wrote : final public class DbLoginModuleImpl implements AbstractServerLoginModule { There is a posting for this whole code somewhere earlier in this forum, on how to extend this jboss AbstractServerLoginModule & do a database authentication. Second issue :- You cannot use a JAAS module only for authentication. JAAS stands for Authentication & Authorization. So as a part of logging in you will have to authenticate & also provide roles. These roles are then used by container in conjunction with j2ee artifacts (web.xml & ejb-jar.xml) to provide role based declarative authorization.This whole process is intimately tied with Roles in j2ee security architecture. Thats why you have anonymous wrote : role elements in web.xml and ejb-jar.xml. If, however you want to provide default Roles, then go ahead, provide default roles & use these in your module and the web.xml and ejb-jar.xml. However you WILL have to provide roles. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4172326#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...