EJB's SessionContext.getCallerPrincipal() returns invalid "ANONYMOUS" principal when user logs in?

Hi all,

we have some JOnAS 5.2 M5 instances running in "production test".

When the system runs under heavy load for some ours, sometimes a strange
problem occurs:

- user that has bookmarked the webapp e.g. as start-page opens the
browser with the URL to our webapp
- tomcat (tomcat6 of jonas5.2 bundle) brings login page as user is not
yet authenticated
- user logs in and the original request is sent to our webapp

so far .. so good. BUT:

in the servlet we get the correct Caller-Principal and the corresponding
username:

logger.log(Level.FINEST, "preparing new HttpSession for user: '"	+
request.getUserPrincipal().getName() + "'");

brings for instance "AL" (request is the http request object)

some lines below, the above method calls an EJB via remote interface
method. within this SLSB method we again
access the userid for some reasons:

try {
			uid = ejbContext.getCallerPrincipal().getName();
		} catch (IllegalStateException e) {
			// no security context exists - ie a nightly batch job:
			return null;
		}


in this case we expect to receive also "AL" as userid --- but we get
"ANONYMOUS"  ?

It looks like this happens when the server is under load - in the normal
case everything works fine with this. 

Somehow could there be a problem that the SLSB instance does not get the
correct security context of the caller ?

regards,
Hans