I suppose you are doing LoginContext.login() from your client. After login, you must be invoking methods on a secured ejb. Did you check, if you are calling LoginContext.logout() ? after completing the call Also try setting "DefaultCacheTimeout" in the jboss-service.xml to 0. Try & see if it helps. Besides I am quite sure that it is not guaranteed by ejb container vendors to return different instances of stateless ejb's between different invocations. So, don't expect different stateless instances to be returned for different client invocations. You could be getting the same underlying instance. So don't programme expecting different instances to be returned. Yes, you can tinker around with the ejb pool. Be cautious whilst you do that View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4203458#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...