i'm getting the following when i try to access a restricted area of my application: -- 403 Forbidden Error initializing security, security-role not found: users -- where might i have forgotten to define: --- web-xml: <security-constraint> <web-resource-collection> <web-resource-name>Everything</web-resource-name> <url-pattern>*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>users</role-name> </auth-constraint> <login-config> <auth-method>BASIC</auth-method> </login-config> </security-constraint> ejb-jar.xml <assembly-descriptor> <security-role> <description>Test</description> <role-name>users</role-name> </security-role> orion-application.xml <security-role-mapping name="users"> <group name="users" /> </security-role-mapping> config/principals.xml <group name="users"> <description>users</description> <permission name="rmi:login" /> <permission name="com.evermind.server.rmi.RMIPermission" /> </group> what did i miss? thanks, jonathan