* @param invocation the object that contains the metadata of the method being called.
* @return the {@code RunAsIdentity} to be used, or {@code null} if no run-as identity can be found.
*/
protected RunAsIdentity getRunAsIdentity(Invocation invocation)
{
RunAsIdentity identity = (RunAsIdentity) invocation.getMetaData("security", "run-as");
if (identity == null)
identity = getAnnotationRunAsIdentity(invocation);
return identity;
}