title: How to propagate JAAS Subject when calling a remote EJB (RMI over IIOP) from a pure client
body: <p>I am testing the propagation of <a href="http://docs.oracle.com/javase/6/docs/api/javax/security/auth/Subject.html" rel="nofollow">JAAS Subject</a> with a <a href="http://docs.oracle.com/javase/6/docs/api/java/security/Principal.html" rel="nofollow">custom Principal</a> from a standalone EJB client running on a raw Java runtime to a JavaEE server. I am targeting both JBoss and WebSphere implementations.</p>
  
  <p>According to <a href="https://community.jboss.org/message/644551" rel="nofollow">this forum thread</a> I have expected it would work with JBoss easily.</p>
  
  <p>Here is my EJB client code code snippet:</p>
  
  <pre><code>Subject subject = new Subject();
  Principal myPrincipal = new MyPrincipal("me I myself");
  subject.getPrincipals().add(myPrincipal);
  
  PrivilegedExceptionAction&lt;String&gt; action = new PrivilegedExceptionAction&lt;String&gt;() {
      public String run() throws Exception {
              String result;
              System.out.println("Current Subject: " + Subject.getSubject(AccessController.getContext()));
              InitialContext ic = new InitialContext();
              Business1 b = (Business1) ic.lookup("StatelessBusiness1");
              result = b.getNewMessage("Hello World");
              return result;
          }
      };
  
  result = subject.doAs(subject, action);
  System.out.println("result "+result);
  </code></pre>
  
  <p>Server-side code is:</p>
  
  <pre><code>public String getNewMessage(String msg) {
      System.out.println("getNewMessage principal: " + sessionContext.getCallerPrincipal());
      System.out.println("Current Subject: " + Subject.getSubject(AccessController.getContext()));
      return "getNewMessage: " + msg;
  }
  </code></pre>
  
  <p>To be sure, even if it is the default behaviour, I have added this section to my <code>ejb-jar.xml</code> session bean:</p>
  
  <pre><code>&lt;security-identity&gt;
     &lt;use-caller-identity/&gt;
  &lt;/security-identity&gt;
  </code></pre>
  
  <p>My session bean is not protected by any role.</p>
  
  <p>According to <a href="http://pic.dhe.ibm.com/infocenter/wasinfo/v7r0/index.jsp?topic=/com.ibm.websphere.express.doc/info/exp/ae/tsec_enablesecattprop.html" rel="nofollow">this IBM WebSphere infocenter section</a>, I have also enabled the system property <code>com.ibm.CSI.rmiOutboundPropagationEnabled=true</code>.</p>
  
  <p>Technically speaking the service call works properly either on JBoss or WebSphere. But the JAAS Subject including my custom principal created on the client is not propagated to the server. Or course, the <code>Subject</code> dumped just before JNDI context creation and EJB call is OK.</p>
  
  <p>I run the same Java runtime version for server and client (IBM Java6 SR9 FP2...), <code>MyPrincipal</code> serializable class is available in server ClassPath (<code>AppServer/lib/ext</code> for WebSphere, <code>server/default/lib</code> for JBoss)</p>
  
  <p>WebSphere dumps:</p>
  
  <pre><code>[8/31/12 11:56:26:514 CEST] 00000024 SystemOut     O getNewMessage principal: UNAUTHENTICATED
  [8/31/12 11:56:26:515 CEST] 00000024 SystemOut     O Current Subject: null
  </code></pre>
  
  <p>JBoss dumps:</p>
  
  <pre><code> 12:30:20,540 INFO  [STDOUT] getNewMessage principal: anonymous
   12:30:20,540 INFO  [STDOUT] Current Subject: null
  </code></pre>
  
  <p>For sure, I have missed some kind of magic spell. Do you know which one ?</p>