My app has a form security domain and security decisions are programmatic and fine grained. This works well for the Servlets. But i also invoke EJB methods that return models based on whether user that requests the model is in a particular role, just like HttpServletRequest::isUserInRole("someRole") is used to make a decision whether return some resource or not, but on a finer level.
That doesn't seem to work - security is not propagated:
@Resource SessionContext ctx; //in a session bean
ctx's getUserPrincipal().getName() always returns "anonymous".
Search throughout the internet didn't net anything positive. I am thinking now of refactoring EJB's methods to accept HttpServletRequest reference, but this will be messy and hacky... just doesn't seem like a good practice.
Have anyone got any tips?