Stateful SB Instance Interceptor should not push SubjectContext if RunAsIdentity present ---------------------------------------------------------------------------------------- Key: JBAS-3781 URL: http://jira.jboss.com/jira/browse/JBAS-3781 Project: JBoss Application Server Issue Type: Bug Security Level: Public (Everyone can see) Components: EJB2 Affects Versions: JBossAS-4.0.5.GA, JBossAS-3.2.8.SP1, JBossAS-5.0.0.Beta Reporter: Anil Saldhana Assigned To: Anil Saldhana Fix For: JBossAS-5.0.0.Beta, JBossAS-3.2.8.SP2, JBossAS-4.0.6.CR1 The following Subject Context push (with null Subject) to establish client security context should not be performed if the user has configured a RunAsIdentity in the caller bean. /* The security context must be established before the cache lookup because the activation of a session should have the caller's security context as ejbActivate is allowed to call other secured resources. Since the pm makes the ejbActivate call, we need to set the caller's security context. The only reason this shows up for stateful session is that we moved the SecurityInterceptor to after the instance interceptor to allow security exceptions to result in invalidation of the session. This may be too literal an interpretation of the ejb spec requirement that runtime exceptions should invalidate the session. */ SecurityActions.pushSubjectContext(mi.getPrincipal(), mi.getCredential(), null); The resolution is: if(SecurityActions.peekRunAsIdentity() == null) SecurityActions.pushSubjectContext(mi.getPrincipal(), mi.getCredential(), null); -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira