create two security domains <security-domain name="sp" cache-type="default"> <authentication> <login-module code="org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule" flag="required"/> </authentication> </security-domain> <security-domain name="idp" cache-type="default"> -> use a login module of your choose, I used LdapExtended Deploy the attached idp.war and sp.war Run the server listening to "localhost" access: http://localhost:8080/plhello result: 403 - Forbidden expected result as seen in EAP 6.1.1: redirect to http://localhost:8080/idp login redirect back to http://localhost:8080/plhello end up on http://localhost:8080/plhello/index.jsp