We are still using JAAS for authentication, the changes are quite minor in term of public API between 2.2 and 2.4 then 2.4 and 2.6. But it is more flexible (2.6 lets you store user preferences in a place other than Database (LDAP for example)), the identity part has just been finished and documentation for it is on the way (It will reach the Wiki first probably) authentication and authorization documentation seems to be lacking in 2.4, but i see that you went ahead and open a JIRA task, this is a good thing but please do not change the priority as said in the READ ME when you submit a Jira task. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3994993#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...