request.isUserInRole() change from 3.2.7 to 4.0.3SP1

[rob_canoe1]

I have two ears deployed in a JBoss container, they contain the same code base- an entity jar and a war file. The ears are configured to have different datasources, JNDI names, JAAS domains (jboss-web.xml) and different class loaders (jboss-app.xml).

The problem I have can be described thus (as seen in V4.0.3.SP1):

login to web app 1 with user sa - this user does not have privilege X
[good] call request.isUserInRole("X") in web app 1 returns false

login to web app 2 with user sa - this user does have privilege X
[good] call request.isUserInRole("X") in web app 2 returns true
[bad] call request.isUserInRole("X") in web app 1 returns true

In V3.2.7 this behaves as expected and request.isUserInRole("X") in web app 1 returns false after the user sa logs into web app 2.

My goal is to have the two applications running independantly, and now this is not the case.

I would be grateful for suggestions as to the config setting I might have wrong, or how I might go about resolving this problem

[starksm64]

Details of the configuration are needed.

[rob_canoe1]

The deployments are as close to the original downloads as I can get them. I am using 'default' of both 3.2.7 and 4.0.3sp1.

There are a couple of changes:

1) added some entries to login-conf.xml for my datasources and jaas names.
2) added a couple of extra jars into the lib directory.

[starksm64]

Create a jira issue with the full details needed to reproduce the behavior.
http://jira.jboss.com/jira/browse/JBAS