title: Can't call EJB 3 security methods without @PermitAll
body: <p>I have an EJB 3.0 Sesion Bean including a "Hello World" Remote Interface and a "HelloWorldBean" SessionBean. Now I tried to add some security to them. This is my SessionBean:</p>
  
  <pre><code>@Stateful
  @SecurityDomain("other")
  @DeclareRoles("ejb")
  @PermitAll
  public class HelloWorldBean implements HelloWorld {
  @Resource
  private SessionContext context;
  
  /**
   * Default constructor.
   */
  public HelloWorldBean() {
      // TODO Auto-generated constructor stub
  }
  
  
  @Override
  @PermitAll
  public String sayHello() throws Exception {
      String s = this.toString();
      s = s + " Security: "+context.isCallerInRole("ejb") + " "+context.getCallerPrincipal().getName();
      return s;
  }
  }
  </code></pre>
  
  <p>I used <code>@PermitAll</code> to test the application in general and it works. If I leave the upper annotation I get an exception that tells me that I'm not allowed to call the method     <code>sayHello()</code>. The method <code>getCallerPrincipal().getName()</code> always returns "anonymous". The following class is my standalone client.</p>
  
  <pre><code>public class EjbAccess3_1_v2 {
  
  
      public static void main(String[] args) throws Exception {
  
          String providerUrl = "remote://localhost:4447";
          final String appName = "NewApplication";
          final String moduleName = "EJB3.1";
          final String distinctName = "";
          final String beanName = "HelloWorldBean";
          final String viewClassName = HelloWorld.class.getName();
          final String ejbPath= appName + "/" + moduleName +  "/" + beanName + "!" + viewClassName;        
  
          Properties environment = new Properties();
          environment.put(Context.INITIAL_CONTEXT_FACTORY, "org.jboss.naming.remote.client.InitialContextFactory");
          environment.put(Context.PROVIDER_URL, providerUrl);
          environment.put("jboss.naming.client.ejb.context", true);
          environment.put(Context.URL_PKG_PREFIXES, "org.jboss.ejb.client.naming");
          environment.put(Context.SECURITY_PRINCIPAL, "ejb");
          environment.put(Context.SECURITY_CREDENTIALS, "password");
          InitialContext initialContext = new InitialContext(environment); 
          HelloWorld remote = (HelloWorld) initialContext.lookup(ejbPath);
  
          System.out.println("EJB V3.1 v2");
          System.out.println(remote.sayHello());
  
      }
  }
  </code></pre>
  
  <p>I'm using JBoss 6 as the application server and created an application user "ejb". The client is working as long as I don't use any security or use the <code>@PermitAll</code> at the SessionBean class and the method, which I want to call. I hope somebody can help me, thanks.</p>