Are you saying that you do not want to use ProgrammaticLogin? In your view is the container supposed to allow anyone to run as the "_system" role? If not , what is the basis on which it is supposed to grant permission for someone to assume the role of "_system"? During deployment, the principal will be "admin" and during other times it is "null" as no one has logged in. If you see other containers, they do the same. Let us know if you know how the container can make the decision to grant the role "_system" without ProgrammaticLogin.
[Message sent by forum member 'raharsha' (raharsha)]
http://forums.java.net/jive/thread.jspa?messageID=236723