getCallerPrincipal() does not work for the first request aft

[kocher]

JBoss 4.0
Tomcat patched according to http://www.jboss.org/index.html?module=bb&op=viewtopic&t=54470

In the stateless session bean the following call
getSessionContext().getCallerPrincipal().getName() works correctly all times except the first request - the following sequence fails:
1. User is not logged in
2. S/he navigates url to restricted area (update user profile) e.g. s/he open browser window and paste url
3. Web server display the login page (form based)
4. User logs in successfully
5. To display the target page getCallerPrincipal().getName() is used. And this method returns "anonymous" instead of user name.

If user presses refresh after that then all is ok - getCallerPrincipal() works.

Is there a patch for this bug?

[starksm64]

This issue was fixed in the 4.0.1RC1 release:
https://sourceforge.net/tracker/?func=detail&atid=376685&aid=1040200&group_id=22866

I'm going to create another 4.0.0 patch that incorporates both security issues in 4.0.0 today.

[starksm64]

See the patch described here:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=57799

[kocher]

Thank you!