I created a loginContext to log in a user, which worked fine at first. It gave me a subject with principles. But after the method finished, JBoss lost the authentication info, so that next time I tried to access a secured jsp it redirected me to the log in page. I tested it with a form submitting to j_security_check, and it worked fine. It seems to only be a problem when submitting to a custom method.