For EJB deployments that contain WS, JBossWS creates a dynamic webapp and attaches the web meta data to the deployment unit. But this JBWMD does not pass through the WARSecurityDeployer. Hence the JACC permissions are not created for this dynamic web app.

Since this dynamic web app is a side effect of the workings of JBossWS and not a behavior of the application, we can live with the WS deployer creating jacc permissions for this dynamic web app.