Irrespective of whether the current ejb defines a RunAs annotation or not, there is a need to push the current RunAsIdentity (can be null) on the RunAs stack in the SecurityAssociation RunAs stack such that a peek into the stack at a depth of 1, always returns the correct RunAsIdentity of the caller. Note that depth 0, would be the current RunAsIdentity of the bean/component in consideration.