I am only new to JAAS in JBoss and as such may not be right, however I don't think your statement is correct.
My understanding is that although you do not need to specify an auth.conf in your webapp you still have to specify the security domain that you are working with. jboss-web.xml is used to store this data and acts as a replacement for auth.conf if you like. The login-config.xml is not a replacement for auth.conf as your auth.conf would only generally point to a configuration in login-config.xml that is wishes to use (not replace its use, at least that is my understanding on how it integrates with JBoss and EJB etc..) So my understanding is that jboss-web.xml is more of a replacement of auth.conf for your webapp. Hope this helps, somebody correct me if I am wrong. Mat View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=3839591#3839591 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=3839591 ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ JBoss-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-user
