In the SP domain add a UsersPasswordLoginModule that loads the roles for the users (same as done in the IDP, you could even point to the same roles.properties file). Add <module-option name="password-stacking">useFirstPass</module-option> to both login modules. This way the EJB JAAS login would retrieve the roles from there and you would be able to access protected methods.

How to reproduce: Follow our documentation: [1] https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/html-single/how_to_set_up_sso_with_saml_v2/index#idp_and_sp_setup_and_configuration In summary in a clean server: setup the two security-domain: ========================= SP Security-Domain: /subsystem=security/security-domain=sp:add(cache-type=default) /subsystem=security/security-domain=sp/authentication=classic:add /subsystem=security/security-domain=sp/authentication=classic/login-module=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule:add(code=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule,flag=required) reload ========================= IDP Security Domain: /subsystem=security/security-domain=idp:add(cache-type=default) /subsystem=security/security-domain=idp/authentication=classic:add /subsystem=security/security-domain=idp/authentication=classic/login-module=UsersRoles:add(code=UsersRoles,flag=required,module-options= [usersProperties=${jboss.server.config.dir}/idp-users.properties,rolesProperties=${jboss.server.config.dir}/idp-roles.properties] ) reload ========================= Create a user in idp-users.properties and set its role in idp-roles.properties under ${jboss.server.config.dir} idp-users.properties Eric=samplePass Alan=samplePass idp-roles.properties Eric=All Alan= ======================== Deploy both applications EJBSecurityTestIDP and EJBSecurityTestSP Access http://localhost:8080/sales-post/rest/test Insert Eric/samplePass It should reproduce the issue.