I'm not sure if this is the right place for this, but since switching to HornetQ, the behaviour of security context on MDBs seem to have changed slightly.
Previously, when a session bean sent a message to an queue to which an MDB subscribes, the message seemed to be processed using the security context of the sender. The behaviour under HornetQ seems less predictable, in that sometimes it seems to be authenticated and sometimes it does not (this could just be non-blocking messages as per the warning on section 31.6.1 of the HornetQ 2.1 manual?)
What is the correct behaviour here? Should the consumer know anything about the user who sent the message?
Message was edited by: Robert Lee to fix typo in section number
