Accessing secured session bean method from MDB (revisited)

[smapjb]

OK, I have read the paid for docs and forums..

I am wrapping a call to a secured session bean method with a "client-login" in my MDB's onMessage() as outlined in earlier posts.

Now I want to remove the jboss security specific stuff from my MDB code and I could use a little help..

My question is Interceptor OR SecurityProxy.. which should I use?

and

Both of these objects return before the bean method is called so where can I call the logout() method of my "client-login" LoginContext.

What are the consequences of not calling logout()?

Yours
Phil

[adrian.brock]

An interceptor does not return before your bean is invoked.

public Object invoke(Invocation mi) throws Exception
{
 login();
 try
 {
 return getNext().invoke(mi);
 }
 finally
 {
 logout();
 }
}

If you don't logout(), the next user of the thread has your established credentials.

[smapjb]

Thanks for the quick response.. of course, the 'like a linked list' bit makes sense now..

Just so I understand this completely; is an interceptor the only way of achieving this?

Did I understand the SecurityProxy correctly.. i.e returns before bean method is called?

Yours
Phil