diff --git a/application-home/conf/datasources.xml b/application-home/conf/datasources.xml
index 18588dd..022ad77 100644
--- a/application-home/conf/datasources.xml
+++ b/application-home/conf/datasources.xml
@@ -5,6 +5,9 @@
 	<datasource id="loginData">
 		<config>
 			<title>login</title>
+			<permissions>
+				<permission ref="anonymous.loginData" mode="set" />
+			</permissions>
 			<meta-data bindClass="org.appng.application.authentication.webform.LoginData">
 				<field name="username" type="text">
 					<label>username</label>
@@ -20,6 +23,9 @@
 	<datasource id="loginDataMandatory">
 		<config>
 			<title>login</title>
+			<permissions>
+				<permission ref="anonymous.loginData" mode="set" />
+			</permissions>
 			<meta-data bindClass="org.appng.application.authentication.webform.LoginData">
 				<validation>
 					<group class="org.appng.application.authentication.webform.LoginData$Login" />
diff --git a/application-home/conf/ev-form-auth.xml b/application-home/conf/ev-form-auth.xml
index 0aba49f..706df60 100644
--- a/application-home/conf/ev-form-auth.xml
+++ b/application-home/conf/ev-form-auth.xml
@@ -8,6 +8,9 @@
 	<action id="login">
 		<config>
 			<title>login</title>
+			<permissions>
+				<permission ref="anonymous.login" mode="set" />
+			</permissions>
 			<params>
 				<param name="form_action" />
 			</params>
@@ -64,6 +67,9 @@
 	<action id="forgotPassword">
 		<config>
 			<title>forgot.password</title>
+			<permissions>
+				<permission ref="anonymous.forgotPassword" mode="set" />
+			</permissions>
 			<params>
 				<param name="form_action" />
 			</params>
diff --git a/src/test/resources/xml/LoginUserTest-testLoginNoData.xml b/src/test/resources/xml/LoginUserTest-testLoginNoData.xml
index 2314455..a9b967a 100644
--- a/src/test/resources/xml/LoginUserTest-testLoginNoData.xml
+++ b/src/test/resources/xml/LoginUserTest-testLoginNoData.xml
@@ -1,53 +1,56 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <action xmlns="http://www.appng.org/schema/platform" id="login" eventId="form-auth">
-    <config>
-        <title id="login">Login</title>
-        <params>
-            <param name="form_action">loginUser</param>
-        </params>
-        <meta-data bindClass="org.appng.application.authentication.webform.LoginData">
-            <validation>
-                <group class="org.appng.application.authentication.webform.LoginData$Login"/>
-            </validation>
-            <field name="username" type="text" binding="username">
-                <label id="username">User</label>
-                <validation>
-                    <notNull>
-                        <message ref="username" class="ERROR" code="{username.required}">{username.required}</message>
-                    </notNull>
-                </validation>
-                <messages ref="username">
-                    <message ref="username" class="ERROR" code="{username.required}">{username.required}</message>
-                </messages>
-            </field>
-            <field name="password" type="password" binding="password">
-                <label id="password">Password</label>
-                <validation>
-                    <notNull>
-                        <message ref="password" class="ERROR" code="{password.required}">{password.required}</message>
-                    </notNull>
-                </validation>
-                <messages ref="password">
-                    <message ref="password" class="ERROR" code="{password.required}">{password.required}</message>
-                </messages>
-            </field>
-        </meta-data>
-    </config>
-    <condition expression="${form_action eq 'loginUser'}"/>
-    <datasource id="loginDataMandatory"/>
-    <userdata/>
-    <data>
-        <selection id="lang" type="select">
-            <title id="lang">lang</title>
-        </selection>
-        <result>
-            <field name="username" type="text">
-                <value></value>
-            </field>
-            <field name="password" type="password">
-                <value></value>
-            </field>
-        </result>
-    </data>
-    <bean id="loginUser"/>
+	<config>
+		<title id="login">Login</title>
+		<permissions>
+			<permission ref="anonymous.login" mode="set"></permission>
+		</permissions>
+		<params>
+			<param name="form_action">loginUser</param>
+		</params>
+		<meta-data bindClass="org.appng.application.authentication.webform.LoginData">
+			<validation>
+				<group class="org.appng.application.authentication.webform.LoginData$Login" />
+			</validation>
+			<field name="username" type="text" binding="username">
+				<label id="username">User</label>
+				<validation>
+					<notNull>
+						<message ref="username" class="ERROR" code="{username.required}">{username.required}</message>
+					</notNull>
+				</validation>
+				<messages ref="username">
+					<message ref="username" class="ERROR" code="{username.required}">{username.required}</message>
+				</messages>
+			</field>
+			<field name="password" type="password" binding="password">
+				<label id="password">Password</label>
+				<validation>
+					<notNull>
+						<message ref="password" class="ERROR" code="{password.required}">{password.required}</message>
+					</notNull>
+				</validation>
+				<messages ref="password">
+					<message ref="password" class="ERROR" code="{password.required}">{password.required}</message>
+				</messages>
+			</field>
+		</meta-data>
+	</config>
+	<condition expression="${form_action eq 'loginUser'}" />
+	<datasource id="loginDataMandatory" />
+	<userdata />
+	<data>
+		<selection id="lang" type="select">
+			<title id="lang">lang</title>
+		</selection>
+		<result>
+			<field name="username" type="text">
+				<value></value>
+			</field>
+			<field name="password" type="password">
+				<value></value>
+			</field>
+		</result>
+	</data>
+	<bean id="loginUser" />
 </action>
diff --git a/src/test/resources/xml/LoginUserTest-testLoginOK.xml b/src/test/resources/xml/LoginUserTest-testLoginOK.xml
index dce5e83..c8a2a20 100644
--- a/src/test/resources/xml/LoginUserTest-testLoginOK.xml
+++ b/src/test/resources/xml/LoginUserTest-testLoginOK.xml
@@ -1,49 +1,52 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <action xmlns="http://www.appng.org/schema/platform" id="login" eventId="form-auth" async="false">
-    <config>
-        <title id="login">Login</title>
-        <params>
-            <param name="form_action">loginUser</param>
-        </params>
-        <meta-data bindClass="org.appng.application.authentication.webform.LoginData">
-            <validation>
-                <group class="org.appng.application.authentication.webform.LoginData$Login"/>
-            </validation>
-            <field name="username" type="text" binding="username">
-                <label id="username">User</label>
-                <validation>
-                    <notNull>
-                        <message ref="username" class="ERROR" code="{username.required}">{username.required}</message>
-                    </notNull>
-                </validation>
-            </field>
-            <field name="password" type="password" binding="password">
-                <label id="password">Password</label>
-                <validation>
-                    <notNull>
-                        <message ref="password" class="ERROR" code="{password.required}">{password.required}</message>
-                    </notNull>
-                </validation>
-            </field>
-        </meta-data>
-    </config>
-    <condition expression="${form_action eq 'loginUser'}"/>
-    <messages>
-        <message ref="login" class="OK">Anmeldung erfolgreich</message>
-    </messages>
-    <datasource id="loginDataMandatory"/>
-    <data>
-        <selection id="lang" type="select">
-            <title id="lang">lang</title>
-        </selection>
-        <result>
-            <field name="username" type="text">
-                <value></value>
-            </field>
-            <field name="password" type="password">
-                <value></value>
-            </field>
-        </result>
-    </data>
-    <bean id="loginUser"/>
+	<config>
+		<title id="login">Login</title>
+		<permissions>
+			<permission ref="anonymous.login" mode="set"></permission>
+		</permissions>
+		<params>
+			<param name="form_action">loginUser</param>
+		</params>
+		<meta-data bindClass="org.appng.application.authentication.webform.LoginData">
+			<validation>
+				<group class="org.appng.application.authentication.webform.LoginData$Login" />
+			</validation>
+			<field name="username" type="text" binding="username">
+				<label id="username">User</label>
+				<validation>
+					<notNull>
+						<message ref="username" class="ERROR" code="{username.required}">{username.required}</message>
+					</notNull>
+				</validation>
+			</field>
+			<field name="password" type="password" binding="password">
+				<label id="password">Password</label>
+				<validation>
+					<notNull>
+						<message ref="password" class="ERROR" code="{password.required}">{password.required}</message>
+					</notNull>
+				</validation>
+			</field>
+		</meta-data>
+	</config>
+	<condition expression="${form_action eq 'loginUser'}" />
+	<messages>
+		<message ref="login" class="OK">Anmeldung erfolgreich</message>
+	</messages>
+	<datasource id="loginDataMandatory" />
+	<data>
+		<selection id="lang" type="select">
+			<title id="lang">lang</title>
+		</selection>
+		<result>
+			<field name="username" type="text">
+				<value></value>
+			</field>
+			<field name="password" type="password">
+				<value></value>
+			</field>
+		</result>
+	</data>
+	<bean id="loginUser" />
 </action>
diff --git a/src/test/resources/xml/LoginUserTest-testLoginWrongPassword.xml b/src/test/resources/xml/LoginUserTest-testLoginWrongPassword.xml
index ed3e716..a18735d 100644
--- a/src/test/resources/xml/LoginUserTest-testLoginWrongPassword.xml
+++ b/src/test/resources/xml/LoginUserTest-testLoginWrongPassword.xml
@@ -1,47 +1,50 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <action xmlns="http://www.appng.org/schema/platform" id="login" eventId="form-auth" async="false">
-    <config>
-        <title id="login">Login</title>
-        <params>
-            <param name="form_action">loginUser</param>
-        </params>
-        <meta-data bindClass="org.appng.application.authentication.webform.LoginData">
-            <validation>
-                <group class="org.appng.application.authentication.webform.LoginData$Login"/>
-            </validation>
-            <field name="username" type="text" binding="username">
-                <label id="username">User</label>
-                <validation>
-                    <notNull>
-                        <message ref="username" class="ERROR" code="{username.required}">{username.required}</message>
-                    </notNull>
-                </validation>
-            </field>
-            <field name="password" type="password" binding="password">
-                <label id="password">Password</label>
-                <validation>
-                    <notNull>
-                        <message ref="password" class="ERROR" code="{password.required}">{password.required}</message>
-                    </notNull>
-                </validation>
-            </field>
-        </meta-data>
-    </config>
-    <condition expression="${form_action eq 'loginUser'}"/>
-    <datasource id="loginDataMandatory"/>
-    <userdata/>
-    <data>
-        <selection id="lang" type="select">
-            <title id="lang">lang</title>
-        </selection>
-        <result>
-            <field name="username" type="text">
-                <value></value>
-            </field>
-            <field name="password" type="password">
-                <value></value>
-            </field>
-        </result>
-    </data>
-    <bean id="loginUser"/>
+	<config>
+		<title id="login">Login</title>
+		<permissions>
+			<permission ref="anonymous.login" mode="set"></permission>
+		</permissions>
+		<params>
+			<param name="form_action">loginUser</param>
+		</params>
+		<meta-data bindClass="org.appng.application.authentication.webform.LoginData">
+			<validation>
+				<group class="org.appng.application.authentication.webform.LoginData$Login" />
+			</validation>
+			<field name="username" type="text" binding="username">
+				<label id="username">User</label>
+				<validation>
+					<notNull>
+						<message ref="username" class="ERROR" code="{username.required}">{username.required}</message>
+					</notNull>
+				</validation>
+			</field>
+			<field name="password" type="password" binding="password">
+				<label id="password">Password</label>
+				<validation>
+					<notNull>
+						<message ref="password" class="ERROR" code="{password.required}">{password.required}</message>
+					</notNull>
+				</validation>
+			</field>
+		</meta-data>
+	</config>
+	<condition expression="${form_action eq 'loginUser'}" />
+	<datasource id="loginDataMandatory" />
+	<userdata />
+	<data>
+		<selection id="lang" type="select">
+			<title id="lang">lang</title>
+		</selection>
+		<result>
+			<field name="username" type="text">
+				<value></value>
+			</field>
+			<field name="password" type="password">
+				<value></value>
+			</field>
+		</result>
+	</data>
+	<bean id="loginUser" />
 </action>