// its session validated. If there is ever a case where we pass Subject as the first parameter
// to an EJB and we do NOT want to validate its session, you need to annotate that EJB
// method with @ExcludeDefaultInterceptors so we don't call this interceptor.
if (subject != null) {
if (subject.getSessionId() != null) {
SubjectManagerLocal subject_manager = LookupUtil.getSubjectManager();
// isValidSessionId will also update the session's last-access-time
if (!subject_manager.isValidSessionId(subject.getSessionId(), subject.getName(), subject.getId())) {
// if this happens, it is possible someone is trying to spoof an authenticated user!
throw buildPermissionException("The session ID for user [" + subject.getName()
+ "] is invalid!", invocation_context);
}
} else {