if you use sso, you should do authentication before jboss loginmodule,and in the jboss loginmodule login method just return true ,and the loginmodule should provide the role information. if you do not use sso,then check the password,and provide the role information in the loginmodule. the loginmodule you write should extend from org.jboss.portal.identity.auth.SynchronizingLdapExtLoginModule or org.jboss.portal.identity.auth.SynchronizingLdapLoginModule .THen you can do what you want to do. override some methods and read the source code if necessary. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4176980#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...