IBM WebSphere V5.0 Security - CGISecurity

Important: Although this feature is commonly referred to as the Run-as Mode,
it does not have any noticeable effect on the bean to which it is applied. A
bean configured to run as a member of a given security role actually executes
using the identity of the caller. It is only when calling methods in other EJBs
that the run as mode applies. These methods are called using the delegated
identity.
5.5.1 Bean level delegation
The EJB 2.0 Specification defines delegation at the EJB bean level using the
element which allows the application assembler to delegate all
methods of a given bean to run as a member of a specific security role. At
deployment time, a real user that is a member of the specified role must be
mapped to this role, through a process which is called run-as role mapping. All
calls to other EJBs made by the delegated bean will be called using the identity
of this mapped user.
Run As Caller (Default)
EJB1
EJB2
caller01
identity=caller01
identity=caller01
Run As Role
Run As
Mapping
username = caller02
password = xxxxxxx
Role01
caller01
EJB1
Run As Role = Role01
identity=caller01
EJB2
identity=caller02
Figure 5-8 Run as Caller versus Run as Role
84 IBM WebSphere V5.0 Security Handbook