Anonymous principal when invoking EJB from a thread inside a servlet

[antlia]

Hi,

I've created some threads inside a servlet for loading content asynchronously because it requires a while to load.

In these threads there are some calls to EJB methods, some of them are associated with an interceptor which verifies the user contained in SessionContext.

I noticed that if these methods are invoked by the servlet's main thread, method getCallerPrincipal returns the right username of the user who logged in in servlet part, but if these methods are invoked by another thread manually created and started inside the same servlet, getCallerPrincipal always returns 'anonymous' causing security exceptions and issues on methods annotated with @RolesAllowed.

For log in I'm using HttpServletRequest.login method.

Does anyone have the same problem? How to manage this?

Thanks,

Antlia

[wdfink]

Manually creating threads is a EE spec violation, you can not expect that the security context is propagated correctly.

An option is to have a Asynchronous EJB method (EJB3.1).

What version of AS do you use?

[antlia]

Thanks for the reply Wolf-Dieter,

in effect i read that manually thread creation in a servlet is an EE violation but, when i made this solution I followed this tutorial (forgot to say that I'm using Vaadin framework)

https://vaadin.com/book/vaadin7/-/page/advanced.push.html

In 11.16.3. Accessing UI from Another Thread example a thread is explicitly spawned in server-side code..so i belived that it won't be a problem.

I'm using EAP 6.2.0 version

[antlia]

I've also tried manual login inside the thread with the code below:

UsernamePasswordHandler handler = new UsernamePasswordHandler(username, password.toCharArray());
try{
     new LoginContext("other",handler).login();
     caseManager = (CaseManagerLocal)new InitialContext().lookup(...);
     caseManager.getCaseList();
}

And even in this case, I'm not able to call the method, same exception.

I understand that spawning thread is a JEE violation, so I should not expect that the principal will be propagated correctly...but why I'm getting the same exception, even doing manual login in the login context?