I think you have it mostly right... However, the JSP that servlet dispatches to has calls to EJB's even before the form, on JSP, is submitted. So EJB's are being called while JSP is being loaded and before the form on JSP is submitted. I put the same statement, request.getRemoteUser(), right before and after the call to EJB. I still get null. Yet EJB methods are responding to their role setting! Does it make sense to you that Roles are being propagated to EJB layer while they are not in Web layer? Thanks View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3981377#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...