Authorization check inside ejb

[pkghosh]

I need to do FilePermission checking inside an ejb. I am planning to call Subject.doAs(). Inside the run() method of PrivelagedAction object I will call AccessController.checkPermission().

I have 2 questions
1. Is this the right approach
2. Inside the ejb how do I get hold hold of the Subject object which I need to pass to doAs().

I am using JAAS client side and server side login. I would appreciate any help

Thanks,
Pranab

[ko5tik]

java.security.Principal p = ctx.getCallerPrincipal();
( where ctx is your session or entity contect )

would give you principal object assotiated woth this
method call
( it would be login name typically )

But it's not so good idea to do file system stuff from EJB...