JBoss 3.0.2: This is related to Bug ID: 608807.
The EJB 2.0 specification allows a call to SessionContext.getCallerPrincipal() in the ejbCreate() method of the Statefull Session Bean. When called from a remote (not in the same VM) client, this throws IllegalStateException: No security context set... The problem as I see it is that the StatefulSessionInstanceInterceptor.invlokeHome() sets the context's principal from the SecurityAssociation's principal. This is ok for in-VM calls since the thread is the same. But for remote calls, the principal comes from the Invocation. Ok, the SecurityInterceptor does associate the principal and credentials from the Invocation to the current thread (SecurityAssociation), but it is called after Instance interceptors (usualy). If I compare the StatefulSessionInstanceInterceptor.invlokeHome() to the EntityInstanceInterceptor.invokeHome(), the later takes the principal from the Invocation. Isn't the same behaviour desired for statefull beans as well? I also spoted the same (maybe wrong) usage in the StatelessSessionInstanceInterceptor.invoke() method. I may not see the whole picture here, but it seems inconsistent. Isn't the principal always packed into Invocation before it is passed to interceptors? I will file this as a bug if I get some kind of confirmation that I'm not wrong here. Regards, Peter ------------------------------------------------------- Sponsored by: AMD - Your access to the experts on Hammer Technology! Open Source & Linux Developers, register now for the AMD Developer Symposium. Code: EX8664 http://www.developwithamd.com/developerlab _______________________________________________ Jboss-development mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-development
