Did you ever solve this?
I'm having the same problem :)
Just to add my name to the list of people having this problem...
Just another few hours and I'll be bald from tearing my hair out :)
I'm also having this very same problem with jboss-3.0.1_tomcat-4.0.4.
Any suggestions, or anyone else got this problem..
Which Login Module are you using?
If it is the ClientLoginModule, then this occurence would make sense since it just binds the input user name to the input password and then "grants" access, without actually doing any kind of authentication! Kind of weird and crazy but true. I had this problem happen to me for a while and thats what it was.
How about posting the relevant pieces of your config files?
Specifically, ejb-jar.xml, jboss and jboss-web.xml and login-config.xml