I have a simple EJB application. It works fine from an application client, including JAAS through DatabaseServerLoginModule, using my "UserBean" table. I set up a web application to go with it. I was able to set up form-based auth, and that also appears to work fine. However, after logging in, I try to execute a method on an EJB, which the user normally can access, and I get the following exception on the console: [ClassBean] Authentication exception, principal=null [Default] java.rmi.RemoteException: checkSecurityAssociation; nested exception is: java.lang.SecurityException: Authentication exception, principal=null [Default] java.rmi.RemoteException: checkSecurityAssociation; nested exception is: java.lang.SecurityException: Authentication exception, principal=null [Default] java.lang.SecurityException: Authentication exception, principal=null [Default] at org.jboss.ejb.plugins.SecurityInterceptor.checkSecurityAssociation(SecurityInterceptor.java:168) What could I be missing? The "auth.conf" with the DatabaseServerLoginModule is in the jboss/conf/tomcat subdirectory, which was my startup config. -- =================================================================== David M. Karr ; Best Consulting [EMAIL PROTECTED] ; Java/Unix/XML/C++/X ; BrainBench CJ12P (#12004) _______________________________________________ JBoss-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-user