Servlet 3.0 AsyncContext and EJB @RolesAllowed in JBoss

Question

reading new Servlet 3.0 specifications, I found startAsynch method for HttpServletRequest, which claims to make things in asynchronous way propagating the right contextual information to the passed runnable.

I wrote this code inside doGet method of my servlet:

@EJB  
private EJBManagerLocal manager;  

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException {  
     if(request.getUserPrincipal() != null && request.isUserInRole("admin"))  
          //Method protected by @RolesAllowes("admin") annotation EJB-side  
          manager.verify();  

     final AsyncContext ctx = request.startAsync(request,response);  
     ctx.start(new Runnable(){  
          HttpServletRequest = (HttpServletRequest)ctx.getRequest();  
          if(request.getUserPrincipal() != null && request.isUserInRole("admin"))  
               //Method protected by @RolesAllowes("admin") annotation EJB-side  
               manager.verify();  
     });  
}  

When calling manager.verify() the first time, outside AsyncContext everything works fine, but when entering inside the Runnable in debug, i can see that, even the 'if' is succesfully passed (so the principal has been correctly propagated to the Runnable in AsyncContext), when calling the EJB method protected by the @RolesAllowed annotation, JBoss throws an exception saying that "The invocation of method verify" is not allowed.

Can anyone help me?

Platform: JBoss EAP 6.2.0

EDIT: Same behavior in JBoss EAP 6.3.0

Answer 1

which claims to make things in asynchronous way propagating the right contextual information to the passed runnable.

The propagation to runnable is met, you are able to access the principal and their roles.

if(request.getUserPrincipal() != null && request.isUserInRole("admin"))

I think the best approach for ejb asynchronous invocations is use @Asynchronous annotation.

See also: Asynchronous Method Invocation

EDIT:

According Java™ Servlet Specification Version 3.0 :

Java Enterprise Edition features such as Section 15.2.2, “Web Application Environment” on page 15-174 and Section 15.3.1, “Propagation of Security Identity in EJB™ Calls” on page 15-176 are available only to threads executing the initial request or when the request is dispatched to the container via the AsyncContext.dispatch method. Java Enterprise Edition features may be available to other threads operating directly on the response object via the AsyncContext.start(Runnable) method.

See this thread in jboss forum, is a similar problem: Anonymous principal when invoking EJB from a thread inside a servlet .