[Jboss-jira] [JBoss JIRA] Created: (JBAS-1860) @RunAs mangles getCallerPrincipal() result

[Jeff S. (JIRA) <jir...@jb...>]

@RunAs mangles getCallerPrincipal() result
------------------------------------------

         Key: JBAS-1860
         URL: http://jira.jboss.com/jira/browse/JBAS-1860
     Project: JBoss Application Server
        Type: Bug
  Components: Security  
 Environment: Problem exists in jboss-head
    Reporter: Jeff Schnitzer


When @RunAs is used, Principal returned from SessionContext.getCallerPrincipal() is "anonymous".  This is contrary to the EJB2.1 spec, section 21.2.5.1 Use of getCallerPrinicpal:

"Note that getCallerPrincipal returns the principal that represents the caller of the
enterprise bean, not the principal that corresponds to the run-as security identity for the bean, if any."

On the next page of the spec is an example of how to use getCallerPrincipal() which will break in JBoss if you apply @RunAs to the ejb method.

It looks like the problem is that SecurityAssociation.getCallerPrinicpal() is simply a cut-and-paste of SecurityAssociation.getPrincipal().

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
   http://jira.jboss.com/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
   http://www.atlassian.com/software/jira