sc = SecurityActions.getSecurityContext();
//TODO: Need to get the SecurityManagement instance
sc.setSecurityManagement(new JNDIBasedSecurityManagement());
//Check if there is a RunAs configured and can be trusted
EJBAuthenticationHelper helper = new EJBAuthenticationHelper(sc);
boolean trustedCaller = helper.isTrusted();
if(!trustedCaller)
{
Subject subject = new Subject();
//Authenticate the caller now
if(!helper.isValid(subject, method.getName()))
throw new EJBAccessException("Invalid User");
helper.pushSubjectContext(subject);
}
else
{
//Trusted caller. No need for authentication. Straight to authorization
}