Isn't this problem of wronly closed ticket? It has been closed as duplicate issue but the ticket duplicated hasn't been resolved.
Status Open [ 1 ] Closed [ 6 ]
Resolution Duplicate Issue [ 3 ]
So wait for the unresolved duplicated ticket to be resolved.
Well, this is one of the reasons why bother with 4.2.X as it's supposed to integrate key bits from Java EE 5 to JBoss 4 branch. To have aligned ejb3 security is important.
Do you think it can get to next minor release of 4.2.X? As JBoss AS 5 is targeted to Q1 2008 (hopefully) and then consequent wait before adopting it to the production environment this is serious stopper issue.
It depends on the EJB3 team. They are quite busy. If you can supply a patch for the problem in 4.2.x, then they can apply it.