java.lang.IllegalStateException in sessionContext.getCallerP

[mihaildruzinin]

I have a question.
I`m use jboss-4.0.5 with ejb3.
From HttpServlet I execute methods from stateless been.
All methods executed correctly with authorization.
When in method I try sessionContext.getCallerPrincipal() throws IllegalStateException: java.lang.IllegalStateException: No valid security context for the caller identity

After see in jboss security module I find that in org.jboss.security.SecurityAssociation getCallerPrincipal()
when used RunAsIdentity, it getted not from top of RunAsIdentity stack, but "for the active run-as the previous caller has assumed":
Principal thePrincipal = peekRunAsIdentity(1); (SecurityAssociation.java:216).
After fixed that string to: Principal thePrincipal = peekRunAsIdentity(0), all work fine.
Please answer, is it a bug and I should report new issue, or I mistake in security configuring.

Start of stack trace:
javax.ejb.EJBTransactionRolledbackException: java.lang.IllegalStateException: No valid security context for the caller identity
org.jboss.ejb3.tx.Ejb3TxPolicy.handleInCallerTx(Ejb3TxPolicy.java:93)
org.jboss.aspects.tx.TxPolicy.invokeInCallerTx(TxPolicy.java:130)
org.jboss.aspects.tx.TxInterceptor$Required.invoke(TxInterceptor.java:195)
org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
org.jboss.aspects.tx.TxPropagationInterceptor.invoke(TxPropagationInterceptor.java:76)
org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
org.jboss.ejb3.stateless.StatelessInstanceInterceptor.invoke(StatelessInstanceInterceptor.java:62)
org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
org.jboss.aspects.security.RoleBasedAuthorizationInterceptor.invoke(RoleBasedAuthorizationInterceptor.java:166)
org.jboss.ejb3.security.RoleBasedAuthorizationInterceptor.invoke(RoleBasedAuthorizationInterceptor.java:108)
org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
org.jboss.ejb3.security.Ejb3AuthenticationInterceptor.invoke(Ejb3AuthenticationInterceptor.java:93)
org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
org.jboss.ejb3.ENCPropagationInterceptor.invoke(ENCPropagationInterceptor.java:47)
org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
org.jboss.ejb3.asynchronous.AsynchronousInterceptor.invoke(AsynchronousInterceptor.java:106)
org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
org.jboss.ejb3.stateless.StatelessContainer.localInvoke(StatelessContainer.java:211)
org.jboss.ejb3.stateless.StatelessLocalProxy.invoke(StatelessLocalProxy.java:79)
$Proxy79.kuku(Unknown Source)
rcbd.e3t1.ejb.TestBean.web(TestBean.java:72)

[anil.saldhana]

There may be a bug. I am not sure.

Answer the following questions:
a) Are you using the latest ejb3 distribution?
b) Is your servlet defining run-as stuff? or are you making a call on the ejb with valid security context (or you logging in?)

If you think there is a bug, open a bug with ejb3 project and maybe attach a sample test project to the JIRA issue that you open.

[mihaildruzinin]

Answer the following questions:
a) Are you using the latest ejb3 distribution?
b) Is your servlet defining run-as stuff? or are you making a call on the ejb with valid security context (or you logging in?)

a) We use EJB 3.0 - Version EJB 3.0 RC7 - FD from jboss-4.0.5, and we set EJB3 RC9 Patch 1 to our jboss.
b) servlet define run-as staff (run-as role and run-as principal)

[anil.saldhana]

Open a JIRA issue with details. Maybe attach a simple test case/app for the ejb3 team to reproduce the issue and fix it asap.

[mihaildruzinin]

Jira issue opened : http://jira.jboss.com/jira/browse/EJBTHREE-913
Atteched test app and patch to fix (be my mind) this issue.