How about only allowing login-required="false" to override if set specifically for one page? That means keep it as it is now, unless an explicitely set login-required="false" for a specific page, not a wildcard, is in effect? Then even in a site that requires login everywhere else one could still have user registration or teaser pages. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4026071#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...