}
});
//Check if there is a RunAs configured and can be trusted
EJBAuthenticationHelper helper = null;
try
{
helper = SecurityHelperFactory.getEJBAuthenticationHelper(sc);
}
catch(Exception e)
{
throw new RuntimeException(e);
}
boolean trustedCaller = hasIncomingRunAsIdentity(sc) || helper.isTrusted();
if(!trustedCaller)
{
Subject subject = new Subject();
/**
* Special Case: Invocation has no principal set,
* but an unauthenticatedPrincipal has been configured in JBoss DD
*/
Principal userPrincipal = sc.getUtil().getUserPrincipal();
String unauthenticatedPrincipal = domain.unauthenticatedPrincipal();
if(userPrincipal == null && unauthenticatedPrincipal !=null &&
unauthenticatedPrincipal.length() > 0)
{
Identity unauthenticatedIdentity = new SimpleIdentity(unauthenticatedPrincipal);
sc.getSubjectInfo().addIdentity(unauthenticatedIdentity);
subject.getPrincipals().add(unauthenticatedIdentity.asPrincipal());
}
else
{
//Authenticate the caller now
if(!helper.isValid(subject, method.getName()))
throw new EJBAccessException("Invalid User");
}
helper.pushSubjectContext(subject);
}
else
{
//Trusted caller. No need for authentication. Straight to authorization
}