Using picketbox-4.0.21.Final that comes bundled with WildFly 8.2.0 Final. There is a security domain named ApplicationRealm, doing a DB based auth, as such:

<security-domain name="ApplicationRealm" cache-type="default">
  <authentication>
  <login-module code="com.login.LoginModule" flag="required" module="org.jboss.login">
  <module-option name="dsJndiName" value="java:jboss/datasources/myDS"/>
  <module-option name="hashAlgorithm" value="SHA"/>
  <module-option name="hashEncoding" value="BASE64"/>
  <module-option name="principalsQuery" value="SELECT u.password FROM Usr u, Client c, UserRole ur WHERE u.logname=? AND (u.status='active' OR u.status='system') AND u.clientId=c.clientId AND (c.status='active' OR c.status='system') AND (u.passwordExpireDate IS NULL OR u.passwordExpireDate &gt; now()) AND u.userId=ur.userId AND u.lockedStatus &lt;&gt;1 AND ur.roleId=20"/>
  <module-option name="rolesQuery" value="SELECT p.label, 'Roles' FROM Usr u, Role r, Privilege p, RolePrivilege rp, UserRole ur WHERE u.logname=? AND u.userId=ur.userId AND u.clientId=ur.clientId AND ur.roleId=r.roleId AND r.roleId=rp.roleId AND rp.privilegeId=p.privilegeId"/>
  <module-option name="unauthenticatedIdentity" value="guest"/>
  </login-module>
  <login-module code="Remoting" flag="optional">
  <module-option name="password-stacking" value="useFirstPass"/>
  </login-module>
  </authentication>
</security-domain>

From my app I can add/remove certain roles that will allow users to access or not certain components.
The problem is that even though the app does update the roles/privileges in the DB picketbox fails to pick-up the new roles/privileges and does not grant the users the new roles/privileges until the server is restarted.

I do suspect some form of caching that is doing this...

Any ideas ?