I have not seen this before, and we run JBoss Portal on JBossAS in Windows 2003. Are there any log entries made in server.log during the time the user fails to log in? And what do you mean by "it does not allow you back in but then eventually you can access it". I more accurate description of the behavior would be helpful. (In other words, is the user getting errors, or do the page simply refresh with the login request, or does the page just not refresh?)
Also, what type of login module are you using?
Also, what version of JBossAS and what JDK?