Ok,
I was starting to suspect something like that, it is really strange.
We have 2 independent system interconnected.
aalmtlp2 user is calling the glassfish ejb which in turn call a web service on an external system. This external system (during the
web service call) is calling back a glassfish ejb using a web service and is authenticating using a user I have called username in
the sample log.
But it seams that in fact it is the roles of the first user aalp2 that are used sometime to verify the access to the web service
called by the external system.
The external system is not glassfish and is completely independent of the glassfish server.
tks.
VD