I found an issue with the JndiLoginInitialContextFactory not creating a SecurityContext and hence not being propagated correctly by the org.jboss.ejb3.security.client.SecurityClientInterceptor. Looking at the SecurityClientInterceptor it seems the logic for creating a SecurityContext if one is not found should be updated to include the principal and credential:

 // Get Principal and credentials
 Principal principal = SecurityActions.getPrincipal();
 if (principal != null) invocation.getMetaData().addMetaData("security", "principal", principal);

 Object credential = SecurityActions.getCredential();
 if (credential != null) invocation.getMetaData().addMetaData("security", "credential", credential);

 //Get the security context
 SecurityContext sc = SecurityActions.getSecurityContext();
 if(sc == null)
 {
 sc = SecurityActions.createSecurityContext();
 SecurityActions.setSecurityContext(sc);
 }

The problem I saw was that the JndiLoginInitialContextFactory has set the principal and credential, but had not created a SecurityContext, and therefore an SC with a null principal and credential was sent over, effectively rendering the principal and credential metadata useless.

Any other older code that is not creating a SecurityContext will also starting failing with the newer SecurityContext based logic. We need to be using the principal and credential when creating a SecurityContext.