* @throws Exception from method call or if no (valid) principal was provided
*/
@AroundInvoke
public Object setCaller(InvocationContext ctx) throws Exception {
Subject caller=null;
java.security.Principal p = ejbContext.getCallerPrincipal();
if (p!=null) {
caller = subjectManager.getSubjectByName(p.getName());
}
if (caller==null) {
throw new IllegalAccessException("No calling principal provided");
}
// Get Subject with a session
caller = sessionManager.put(caller);
// Provide it to the EJB
AbstractRestBean target = (AbstractRestBean) ctx.getTarget();
target.caller = caller;
// Call the EJBs
Object result = ctx.proceed();
// if result is StreamingOutput, we do not want to invalidate the session until it
// is finished writing the output; otherwise, any secure SLSB calls will fail. We
// instead wrap the result in an instance of SecureStreamingOutput which
// invalidates the session after the output has been written.
if (result instanceof StreamingOutput) {
return new SecureStreamingOutput((StreamingOutput) result, caller);
}
// Invalidate the session again.
sessionManager.invalidate(caller.getSessionId());
return result;
}