The "portal.principal" session attribute is not set to the authenticated user, in my case, and that is what is causing the problem. I have 2 apps, running in JBoss and the custom login module implementation code is part of a shared library used by both these apps. However, the session is different for these 2 apps, and hence, the authenticated user doesn't seem to be set in the session for the 2nd app. Does this make sense, and is this a JBoss bug?? Is there a workaround? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4071280#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...