caching of EJBContext in a CustomSecurityProxy

[tvoelker]

My question is how to cache the EJBContext in a CustomSecurityProxy between setEJBContext and invoke? I need some information e.g. the CallerPrincipal for authorization checks in invoke.

As far as i have seen there is only one SecurityProxy instance per bean class not per bean instance. And so i assume that using a local attribute in the SecurityProxy will cause some trouble in concurrent access situations.

Thanks in advance
Torsten

[croweec]

To cache your EJBContext so that you can use it within invoke() you must use ThreadLocal.

Check this site out for a good example:
http://www.javaworld.net/javaworld/jw-02-2002/jw-0215-ejbsecurity_p.html

It goes like the following in your security proxy:
1) Add a ThreadLocal member:
private ThreadLocal _ctx = new ThreadLocal();
2) Set your ThreadLocal with the EJBContext within your setEJBContext method:
_ctx.set(pContext);
3) Utilize your EJBContext within your invoke() method by calling get:
EJBContext ctx = _ctx.get()
4) You should be able to clear the EJBContext from the thread:
_ctx.set(null);