MBean method invocation cleans SecurityAssociation

[maaaah]

Hi All!
I am using JBoss 3.2.3.
I am trying to invoke an MBean method from a secured Stateless Session Bean. For example:

beanMethod() {

...
RMIAdaptor server = ...
...
System.out.println("PRINCIPAL BEFORE MBEAN METHOD CALL = " + SecurityAssociation.getPrincipal())
server.invoke(...);
System.out.println("PRINCIPAL AFTER MBEAN METHOD CALL = " + SecurityAssociation.getPrincipal())

...

}

I am getting two following lines:
PRINCIPAL BEFORE MBEAN METHOD CALL = user
PRINCIPAL AFTER MBEAN METHOD CALL = null

So, MBean method invocation destroys SecurityAssociation!!! And I can not call another secured EJBs in businessMethod() after MBean call.
HELP ME PLEASE!

[starksm64]

The RMIAdaptor is not usable from within the server if you expect the security context to be maintained. Its purpose is for access from external clients where the security context cannot be leaked to the transport thread pool.

Use the MBeanServer directly.

[maaaah]

Oh, thank you! It works!

But I have already written my own SecuredInvokerAdaptorService, which simple restores SecurityAssociation info instead of clear it.

Look at InvokerAdaptorService.java, line 266:

SecurityAssociation.clear();

But I put the following lines there instead:

SecurityAssociation.setPrincipal(storedPrincipal);
SecurityAssociation.setCredential(storedCredential);

where storedPrincipal and storedCredential contains Principal and Credential which SecurityAssociation had before MBean invocation.

I am not sure it is correct. Can you answer me is it correct modification or have I broken something?
Thank you.

[starksm64]

Your leaking the security context back to the calling thread. Its up to you to decide if this is broken behavior in your environment.