[JBoss-user] application security configuration

[Gary S. C. <gar...@in...>]

Hello all,
I'm at the point of configuring security parameters for my app and have 
a few questions.

I ultimately want to use the DatabaseServerLoginModule and authenticate 
via a web-app, but have been trying some of the simpler modules just to 
get started.  So far I have not been successful.

So far, I've created a login-config.xml file and put it in my ear file. 
 I've also added the security domain to my jboss.xml.  As a test, I 
created an empty method on a session bean and set some permissions in 
the ejb-jar.xml file to test with.  So far, I've just tried to connect a 
stand-alone client to the remote interface of the session bean.  ALL of 
my calls fail, even to methods that don't have permissions configured.

Oddly enough, all of my exceptions reference the UserRolesLoginModule 
(which I'm not specifying to be loaded) and complain about not having 
user/password files set up.  Where would this come from?  I'm sure I'm 
just missing/overlooking something stupid.  I'd be happy to forward any 
support files if needed.

I'm using 3.0.0 with embedded tomcat 4.0.3.

Thanks in advance for any help...
gary.