title: Adding custom context information to EJB method calls
body: <p>I want to pass authentication information to EJB stateless session beans when calling their methods from a Java web application (Wicket). The information consists of a user id and an authentication type (remember cookie or user/password) and is stored in the http session. One obvious solution is to add this as a parameter to all EJB methods, but this is cumbersome and I hope another solution exists.</p>
  <p>The JNDI lookup of EJB beans is done via javax.naming.InitialContext#lookup(String) in the web tier.</p>
  <p>Is there a portable way to add the authentication information to a calling context so it becomes available to the beans? I need this process to be available for callers both in the EJB layer (for an eventual web service endpoint) and in the web tier.</p>
  <h3>Some more information</h3>
  <p>I am using Java EE 6. CDI is not used and I would rather avoid implementing it.</p>
  <p>Authentication is handled by the web tier with stateless beans validating remember cookies and user/password combinations. When a visitor first accesses the site, authentication with the remember cookie is tried. When eventually required, the user is asked to login with a username and password. As mentioned above, the authentication status is stored in the http session. I don’t use the Java EE security model based on realms because I couldn’t figure out how this authentication flow could be properly integrated.</p>
  <p>The authorization scheme is based on dynamic roles similar to how Facebook determines authorization based on the link between 2 users and some preferences. Some actions also take into account the authentication type. For instance, modifying account settings requires user/password and the cookie is not enough. From what I understood, the Java EE standard groups and roles are not a good fit for this requirement.</p>
  <h3>Other related questions I found</h3>
  <p><a href="https://stackoverflow.com/questions/7196706/ejb3-how-jaas-subject-principal-is-propagated-to-ejb-tier-from-servlet-contain">EJB3 &amp; How JAAS subject/principal is propagated to EJB Tier from servlet container?</a></p>
  <p><a href="https://stackoverflow.com/questions/2517241/controlling-the-security-principle-passed-on-a-ejb-call">Controlling the security Principle passed on a EJB call</a></p>
  <p><a href="https://stackoverflow.com/questions/6819793/binding-a-user-entity-and-a-glassfish-principal">Binding a User entity and a GlassFish Principal</a></p>
  <p><a href="https://stackoverflow.com/questions/2363716/accessing-the-clients-principal-inside-an-ejb-method">Accessing the clients principal inside an ejb method</a></p>
  <p><a href="https://stackoverflow.com/questions/2230717/dynamic-roles-on-a-java-ee-server">dynamic roles on a Java EE server</a></p>
  <p>I hope my question is clear enough. If more information is required, I will gladly provide it.</p>
  <h3>edit</h3>
  <p>Fixed links. Add note about CDI.</p>