public Object invoke(Invocation mi) throws Exception 
{
  
      if(this.shouldBypassSecurity(mi))
         return getNext().invoke(mi);
      SecurityContext sc = SecurityActions.getSecurityContext(); 
      if( sc == null)
         throw new IllegalStateException("Security Context is null"); 
      RunAs callerRunAsIdentity = sc.getIncomingRunAs(); 
      // Authenticate the subject and apply any declarative security checks
      try
      {
         checkSecurityContext(mi, callerRunAsIdentity); 
      }  
      catch(Exception e)
      {
         log.error("Error in Security Interceptor",e);
         throw e;
      }
      /**
       * Special case: if < use-caller-identity > configured and
       * the caller is arriving with a run-as, we need to push that run-as
       */
      if(callerRunAsIdentity != null && this.isUseCallerIdentity)
         this.runAsIdentity = callerRunAsIdentity;
      /* If a run-as role was specified, push it so that any calls made
       by this bean will have the runAsRole available for declarative
       security checks.
      */
      SecurityActions.pushRunAsIdentity(runAsIdentity); 
      try
      {
         Object returnValue = getNext().invoke(mi);
         return returnValue;
      }
      finally
      {  
         SecurityActions.popRunAsIdentity(); 
         SecurityActions.popSubjectContext();  
      }
}

 public Object invokeHome(Invocation mi) throws Exception 
{
  
      if(this.shouldBypassSecurity(mi))
         return getNext().invokeHome(mi);
      SecurityContext sc = SecurityActions.getSecurityContext(); 
      if( sc == null)
         throw new IllegalStateException("Security Context is null"); 
      RunAs callerRunAsIdentity = sc.getIncomingRunAs(); 
      // Authenticate the subject and apply any declarative security checks
      try
      {
         checkSecurityContext(mi, callerRunAsIdentity); 
      }  
      catch(Exception e)
      {
         log.error("Error in Security Interceptor",e);
         throw e;
      }
      /**
       * Special case: if < use-caller-identity > configured and
       * the caller is arriving with a run-as, we need to push that run-as
       */
      if(callerRunAsIdentity != null && this.isUseCallerIdentity)
         this.runAsIdentity = callerRunAsIdentity;
      /* If a run-as role was specified, push it so that any calls made
       by this bean will have the runAsRole available for declarative
       security checks.
      */
      SecurityActions.pushRunAsIdentity(runAsIdentity); 
      try
      { 
         Object returnValue = getNext().invokeHome(mi);
         return returnValue;
      }
      finally
      {  
         SecurityActions.popRunAsIdentity(); 
         SecurityActions.popSubjectContext();   
      }
}

 public  void setContainer(Container container) 
{
    
      super.setContainer(container);
      if (container != null)
      {
         BeanMetaData beanMetaData = container.getBeanMetaData();
         ApplicationMetaData applicationMetaData = beanMetaData.getApplicationMetaData();
         AssemblyDescriptorMetaData assemblyDescriptor = applicationMetaData.getAssemblyDescriptor();
         securityRoles = assemblyDescriptor.getSecurityRoles();
         deploymentRoles = assemblyDescriptor.getPrincipalVersusRolesMap();
         SecurityIdentityMetaData secMetaData = beanMetaData.getSecurityIdentityMetaData();
         if (secMetaData != null && secMetaData.getUseCallerIdentity() == false)
         {
            String roleName = secMetaData.getRunAsRoleName();
            String principalName = secMetaData.getRunAsPrincipalName();
            //Special Case: if RunAsPrincipal is not configured, then we use unauthenticatedIdentity
            if(principalName == null)
               principalName = applicationMetaData.getUnauthenticatedPrincipal();
            // the run-as principal might have extra roles mapped in the assembly-descriptor
            Set extraRoleNames = assemblyDescriptor.getSecurityRoleNamesByPrincipal(principalName);
            runAsIdentity = new RunAsIdentity(roleName, principalName, extraRoleNames);
         }
         if (secMetaData != null && secMetaData.getUseCallerIdentity())
            this.isUseCallerIdentity = true;
         securityManager = container.getSecurityManager();
         realmMapping = container.getRealmMapping();
         //authorizationManager = container.getAuthorizationManager();
         try
         {
            // Get the timeout method
            ejbTimeout = TimedObject.class.getMethod("ejbTimeout", new Class[]{Timer.class});
         }
         catch (NoSuchMethodException ignore)
         {
         }
         if(securityManager != null)
         {
            appSecurityDomain =  securityManager.getSecurityDomain();
            appSecurityDomain = SecurityUtil.unprefixSecurityDomain(appSecurityDomain); 
         } 
         ejbName = beanMetaData.getEjbName();  
         ejbCS = container.getBeanClass().getProtectionDomain().getCodeSource();
         securityManagement = (ISecurityManagement) container.getSecurityManagement();
      }
}

Called by the super class to set the container to which this interceptor belongs. We obtain the security manager and runAs identity to use here.

 public  void start() throws Exception 
{
      super.start();
      authenticationObserver = 
         (AuthenticationObserver) Registry.lookup(AuthenticationObserver.KEY);
      //Take care of hot deployed security domains
      if(container != null)
      {
         securityManager = container.getSecurityManager();
         if(securityManager != null)
         {
            appSecurityDomain =  securityManager.getSecurityDomain();
            appSecurityDomain = SecurityUtil.unprefixSecurityDomain(appSecurityDomain); 
         }  
      }
}