[ https://issues.jboss.org/browse/JBWS-3700?page=com.atlassian.jira.plugin.... ] Jim Ma commented on JBWS-3700: ------------------------------ can you please configure the security constraint to servlet like the follow example to see if it works ? {code} <servlet> <servlet-name>HelloImpl</servlet-name> <servlet-class>org.jboss.test.ws.jaxws.jbws2307.HelloImpl</servlet-class> <load-on-startup>0</load-on-startup> <security-role-ref> <role-name>FRN</role-name> <role-link>friend</role-link> </security-role-ref> </servlet> <servlet-mapping> <servlet-name>HelloImpl</servlet-name> <url-pattern>/jaxws/Hello</url-pattern> </servlet-mapping> <session-config> <session-timeout>54</session-timeout> </session-config> <security-constraint> <web-resource-collection> <web-resource-name>WSHelloSecureService</web-resource-name> <url-pattern>/jaxws/*</url-pattern> <http-method>POST</http-method> </web-resource-collection> <auth-constraint> <role-name>friend</role-name> </auth-constraint> <user-data-constraint> <transport-guarantee>NONE</transport-guarantee> </user-data-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> <realm-name>default</realm-name> </login-config> <security-role> <role-name>friend</role-name> </security-role> {code} -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira