Alternatively, if I can't get JBoss to ask me who the currently logged in user is, can I explicitly tell it, like in a GenericSOAPHandler, xxx.yyy.setPrincipal()? Or where can I find information about a requests processing order? For example it would be good to know if session state is established BEFORE checking the @RolesAllowed declarative security. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4249969#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...