I can't find any answers, do somebody know what is exactly transmitted when a server call another? username and password are transmitted since they used to authenticate on the second sever, but how? in the Callbackhandler? And is there anything else that is transmitted?
Look at the client proxy interceptors,org.jboss.ejb.proxy package and you'll find what goes inside the invocation payload.