<p>I'm working on an existing j2ee app and am required to remove some vendor specific method calls from the code.</p>

<p>The daos behind a session facade make calls into the ejb container to get the user's id and password - in order to connect to the database.  The user id and password part of the initialContext used to connect to the server.</p>

<p>I am able to get the userid using <code>sessionContext.getCallerPrincipal()</code></p>

<p>Is there anyway to get to the <code>SECURITY_CREDENTIALS</code> used on the server connection or, is there a way to pass information from the server connection into the ejbs (they are all stateless session beans).</p>

<p>This is a large app with both a rich-client and web front end, and in a perfect world I'd be happy to go back and re-architect the entire solution to use J2EE security etc - but unfortunately, that is not realistic.</p>

Normally the Java EE security model will not allow the retrieval of the user password, for security reasons. But it depends on the implementation. Some vendors provide methods to retrieve this kind of information, but if you rely on such implementations, be aware that the portability of the application will be compromised.
One common approach is to write a servlet filter to intercept the login request and save a copy of the credentials, to be used later. If your application doesn't use the Java EE security infrastructure, this could be easily implemented. That's because some vendors prevent you from filtering an authentication servlet.