java ee - What are the techniques to manage "session" or invocation context for Stateless EJBs during Remote calls? -

i writing application uses rmi invoke ejbs. ejbs stateless; business requirements not require conversational state client.

one of parameters ejb method calls "user" object used determine if user associated call has permission perform action. not using container-managed auth-auth: user object pojo provided remote client.

i make user object globally available/injectable within "session" or invocation context. aware stateless ejbs not have "session" in ejb sense; mean "session" "the current invocation". example, have 1 remote ejb 2 methods:

• mystatelessejb.add(thing, user)
• mystatelessejb.update(thing, user)

these methods call many more methods: there other ejbs involved, bean validators, etc. rather passing-around user object everywhere, make user object globally available/injectable context of current remote ejb invocation.

i of course pass around user object or encapsulate "thing", thought maybe better design not "pollute" objects , apis user since it's cross-cutting concern.

notes (for emphasis):

• i using rmi.
• there no http session, because using rmi.
• i not using container-managed auth-auth.
• i using container-managed transactions.

is there standard technique suitable problem? e.g. perhaps remote client should invoke stateful ejb hold user, or maybe threadlocal appropriate, or maybe can hook onto container-managed transaction, or maybe there's applicable session/context i'm unaware of.

easiest way store user in @requestscoped cdi bean , inject required:

@requestscoped public class requestuser {     private user user;      //getter , setter user }  @remote @statless public class myremoteinterface {    @inject    private requestuser requestuser;    ...    public void foo(user user, bar bar) {       request.setuser(user);       ...    } }  @stateless public class otherejb() {     @inject     private requestuser user;      public void dobar(bar bar) {         user user = user.getuser();         ...     }  } 

while @sessionscoped useful http sessions only, @requestscoped has broader applicability:

public @interface requestscoped

specifies bean request scoped.

the request scope active:

• during service() method of servlet in web application, during dofilter() method of servlet filter , when container calls servletrequestlistener or asynclistener,
• during java ee web service invocation,
• during remote method invocation of ejb, during asynchronous method invocation of ejb, during call ejb timeout method , during message delivery ejb message-driven bean, and
• during message delivery messagelistener jms topic or queue obtained java ee component environment.