Deploy the attached webapp, module, and configuration to two, standalone (clustered) Wildfly servers. Open your browser and go to http://<server1>/example/restricted-user-info.jsp Login with username "jdoe" and password "jdoe" (any username/password combo where username=password will work). Once logged in, you should see a page listing the username and security roles. Open another browser tab and go to http://<server2>/example/restricted-user-info.jsp This leads to a 403 (Forbidden) error because you no longer have the necessary security roles. You can point your browser to http://<server2>/example/user-info.jsp to verify that the user is still known, but all security roles have been removed. Additionally, this user info is, again, replicated back to server 1, wiping out the security roles there as well.