The fix for https://issues.jboss.org/browse/AS7-6476 basically pointed out that 1) the testcase needs to be enhanced 2) the testcase assumes method with no security role restrictions (but with roles declared for the app) can be invoked, but that's not the default behaviour anymore on AS 7.2.