Currently I have two applications, a backend and a frontend EAR application, and I am deploying these to two Wildfly servers in a domain – a backend and a frontend server. Both of the applications have EJBs in them, and for some tasks, the frontend application calls the backend application with remote JNDI lookup.
The goal is to only allow specific operations to specific roles, so I am using @RolesAllowed in both applications. This works fine in the frontend applications, the user authenticates with basic auth, and the principal of the request is set accordingly. However, on the backend I lose the principal after looking up the remote beans: if I use manaully create a Context with a username and a password, I obviously get that user as the principal, and if I use @EJB(lookup = ...), then I get $local as the principal.
So this is where I need help, I would like to preserve the original principal. My initial idea was creating the Context with the current principal, but I can't seem to do that without the password.