Now where will the client side interceptors pick up the caller Security Context from? I need something like the old SecurityAssociation threadlocal. This is just a minute issue but this is where I cannot throw away the threadlocal concept. In my current prototype, I have a SecurityContextAssociation with a single threadlocal to hold the securitycontext object. The Security Interceptor in the proxy looks at the threadlocal object to obtain the call-path security context. If it exists and it holds the invocation principal(means there is no explicit jaas login), I just send the security context over the invocation. If the invocation principal does not match with the SC on the threadlocal, it means there is an explicit jaas login - create a new SC (plug the call-path sc as its parent) and set this new SC on the threadlocal as well as sending it on the invocation. Takes care of end-to-end security. The security context can hold the caller's security context and be passed via invocation. So we get the stack like behavior for the caller's context. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3997373#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...