JBoss 4.2.1: How to propagate authorization from web to EJB

[sergerus]

Hello!

I'm using JBoss 4.2.1 and I have multitier application. In web part I'm using container-based authorization (web.xml, login form). In EJB part I'm using container-based authorization too with @RolesAllowed annotation. Ok. When I login into application I get all my principal/roles. But if somebody else login after me - he get my principal and roles in secured methods. In unsecure methods he get own principal/roles.

Help please.

[welle]

Should work... Seems like a bug. Can you provide a testcase?

[sergerus]

Oh. Pardon me please! It was my mistake. I'm using Eclipse RAP framework, it use global ThreadPool. So security context correct propagate from parent to child thread, but there is no guarantee that parent and child context are equals.

Many thanks!