Trust between EJBs
<p>I have a bunch of EJBs using declarative security and I need to make an EJB to trust on another one.</p>

<p>For example</p>

<pre><code>class ServiceOne {

    @EJB
    private ServiceTwo service;

    @RolesAllowed("role1")
    public void doSomething() {
        // do several things here...
        service.giveMeInfo();
    }
}


class ServiceTwo {

    @Resource
    private SessionContext ejbCtx;

    @RolesAllowed("role2")
    public String giveMeInfo() {
        System.out.println("OK user " + ctx.getCallerPrincipal());
        return str;
    }
}
</code></pre>

<p>The user calling serviceOne.doSomething() has only "role1", he doesn't have "role2", that is needed to call giveMeInfo(), but I want to allow him call this method anyway, because it is from ServiceOne (which is allowed).</p>

<p>If I use a @RunAs based strategy, I loss information about the real user, since getCallerPrincipal() would give me only the role specified with anonymous principal, but I need to keep original caller information.</p>

<p>(ps: I'm using JBOSS eap 6.)</p>

<p>Thanks in advance.</p>