Maros Bajtos wrote:
The problem as I found out is that with every(!) ejb invocation, ClassLoader.loadClass(String) is called. This is a sample trace (it is called also in other places):
org.jboss.ejb3.security.RoleBasedAuthorizationInterceptorv2.invoke
SecurityHelperFactory.getEJBAuthorizationHelper
SecurityActions.loadClass
ClassLoader.loadClass
That really looks silly and ugly :( The whole security interceptors aren't really efficient (in terms of performance) because of the lack of simple API to interact with the security layer. By the way, if you don't have @SecurityDomain or security-domain for the bean, then that flow shouldn't come into picture. But yes, that entire code piece needs improvement.