thanks for the tip. I didn't know about jboss-app.xml. Now it seems to work and I can access the principal in my struts action. Is my assumption correct that after a successful SPNEGO authentication I can always get the principal with the "getUserPrincipal" method of the HttpServletRequest object? and is the principal null if the authentication failed? that behaviour would be exactly what I need to display the user a form with a login when SPNEGO failed or is not configured. Claus View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4168998#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...