My configuration:

JBoss 4.0.3SP1
JBossPortal2.2

I've created my own portal instance and I included in it the web.xml configuration file. I set the login-config and security-constraint configurations as I need but, when I log-in in my portal, these configurations are ignored and JBossPortal uses his default configurations (I see this because I created a new login jsp that is ignored).

Here is my web.xml file:

<?xml version="1.0"?>
<!DOCTYPE web-app PUBLIC
"-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
"http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>

<!-- The portal servlet is the main entrance point -->

<servlet-name>PortalServletWithPathMapping</servlet-name>
<servlet-class>org.jboss.portal.server.servlet.PortalServlet</servlet-class>
<init-param>
<param-name>asDefaultServlet</param-name>
<param-value>false</param-value>
The servlet needs to know wether it is set as a default servlet or not
</init-param>
<load-on-startup>0</load-on-startup>
<security-role-ref>
<role-name>Authenticated</role-name>
<role-link>Authenticated</role-link>
</security-role-ref>


<!-- The portal servlet is the main entrance point -->

<servlet-name>PortalServletWithDefaultServletMapping</servlet-name>
<servlet-class>org.jboss.portal.server.servlet.PortalServlet</servlet-class>
<init-param>
<param-name>asDefaultServlet</param-name>
<param-value>true</param-value>
The servlet needs to know wether it is set as a default servlet or not
</init-param>
<load-on-startup>0</load-on-startup>
<security-role-ref>
<role-name>Authenticated</role-name>
<role-link>Authenticated</role-link>
</security-role-ref>


<servlet-mapping>
<servlet-name>jsp</servlet-name>
<url-pattern>/GFMyPortal2.2/gflogin.jsp</url-pattern>
</servlet-mapping>

<servlet-mapping>
<servlet-name>jsp</servlet-name>
<url-pattern>/GFMyPortal2.2/gferror.jsp</url-pattern>
</servlet-mapping>

<servlet-mapping>
<servlet-name>jsp</servlet-name>
<url-pattern>*.jsp</url-pattern>
</servlet-mapping>

<servlet-mapping>
<servlet-name>/auth/portal/GFPortal/*</servlet-name>
<url-pattern>*.jsp</url-pattern>
</servlet-mapping>

<session-config>
<session-timeout>15</session-timeout>
</session-config>

<security-constraint>
<web-resource-collection>
<web-resource-name>GFAuthenticated resources</web-resource-name>

<url-pattern>/auth/portal/GFPortal/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>Authenticated</role-name>
</auth-constraint>
</security-constraint>

<login-config>
<auth-method>FORM</auth-method>
<realm-name>JBoss Portal</realm-name>
<form-login-config>
<form-login-page>/GFMyPortal2.2/gflogin.jsp</form-login-page>
<form-error-page>/GFMyPortal2.2/gferror.jsp</form-error-page>
</form-login-config>
</login-config>

<security-role>
<role-name>Authenticated</role-name>
</security-role>

</web-app>

anyone can help me?
Thanks, Paolo.