Have created a web app packaged in a app.war. In its WEB-INF/classes are two files: users.properties and roles.properties. In its WEB-INF/jboss-web.xml is the line <security-domain>java:/jaas/webapp-policy</security-domain> In <JBOSS_ROOT>/server/default/conf/login-config.xml I have | <application-policy name="webapp-policy"> | <authentication> | <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" flag="required" > | <module-option name="usersProperties">users.properties</module-option> | <module-option name="rolesProperties">roles.properties</module-option> | <module-option name="roleGroupSeperator">.</module-option> | </login-module> | </authentication> | </application-policy> | Iff I deploy the app.war into the deploy folder, the login works perfectly. NOTE: No users and roles.properties in <JBOSS_ROOT>/server/default/conf folder. However, I planned to use this war file as the default web application for a particular virtual host, so I created a new host entry in <JBOSS_ROOT>/server/default/deploy/jbossweb-tomcat55.sar/server.xml, specifying another appBase location and supplying it with a context with an empty name. I created this folder and copied the app.war file into that folder and subsequently started the server. Two new folders were created (app and ROOT) in the new folder. But now the login does not function any more (a simple FORM based login that protects some of the pages in the app.war). I'm using out-of-the ZIP JBoss-4.0.5GA, and I had a peek at the property loading mechanism, and for all I could see the loading of the properties are a straight forward Java property loading that features the classpath (at that point in application startup). Finally, the question: Have I missed anything obvious here, or is this another twist of the classloader feature? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4025190#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...