you can use ProgrammaticLogin on the client side, but you must configure the ejb to require client authentication, or else the client credentials will not be sent and used for the ejb-invocation.
http://docs.sun.com/app/docs/doc/819-3669/bnbzk?a=view
you can also use ProgrammaticLogin on the sever side, but you will need to perform the login for every request.
the web container supports authentication sessions. A third alternative would be to front your ejb component with a web component, and the web layer (session identity) will be propagated to the ejb tier.
Ron
[Message sent by forum member 'monzillo' (monzillo)]
http://forums.java.net/jive/thread.jspa?messageID=276786