Request.isUserInRole doesn't allow an interceptor to DECLINE (and is inconsistent with Context). The following change to org/apache/tomcat/core/Request.java brings it in line: 488c488 < if ( status != 0 ) { --- > if ( status != BaseInterceptor.DECLINED ) { 492c492 < return status==0; --- > return status==BaseInterceptor.OK; --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, email: [EMAIL PROTECTED]