Try this :- (1) JAR the following classes MyCustomPrincipal and MyCustomLoginModule . (2) Put the JAR in $HOME/server/default/lib. (3) Modify the run.sh or run.bat to pick up this JAR in its classpath. (4) Remove these classes from your WAR. This way, the module and its customPrincipal are in the server's CLASSLOADER and not in the WAR's CLASSLOADER. Remember, the JAAS module is used for securing all applications that run on the Server & not individual web application (5) Now the casting should work. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4185578#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...