use-caller-identity should be default if no explicit security-identity is set in --------------------------------------------------------------------------------- Key: JBAS-7405 URL: https://jira.jboss.org/jira/browse/JBAS-7405 Project: JBoss Application Server Issue Type: Bug Security Level: Public (Everyone can see) Components: EJB2 Affects Versions: JBossAS-5.1.0.GA Reporter: Sverker Abrahamsson Assignee: Alexey Loubyansky According to http://www.redhat.com/docs/manuals/jboss/jboss-eap-4.2/doc/Server_Configu... if no explicit security-identity is set in ejb-jar on a bean, then propagation of the caller identity should be the default. That is not currently the case, if no security-identity is set then useCallerIdentity remains false. I believe the bug is in org.jboss.ejb.plugins.SecurityInterceptor#setContainer and that adding the follwing at line 160 (on the JBossAS 5.1.0.GA version) should solve the problem: if (secMetaData == null) this.isUseCallerIdentity = true; Could be that this bug was introduced with the fix for JBAS-5011, for some reason I can't get fisheye to work right now to check it out. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira