Hi again so am i right in saying that in the case below SMSLDAP will be used to authenticate the user trying to login and then the authenticator.authenticate method is called, and it is here that i can add my roles to the actor object. <security:identity authenticate-method="#{authenticator.authenticate}" jaas-config-name="SMSLDAP"/> because otherwise i dont see what purpose the authenticator.authenticate method serves. Im a noob .... i know... i hate secuirity.... i prefer unreal tournament and beer... cheers again lads View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4066822#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...