2 methods:
1. create a session object which reserve the user information, and pass it from jsp to the ejb tire. For you have to pass session to the rear state, you have to pass the request object, because the request object is not serialized so you have to pass a serialized object which contains the necessary variables as a helper class. This method is not commended, for it does not quit fit to the j2ee architechture. and you don't not take the advantage of j2ee and ejb.
2. use security apis, eg security realm. it can provide you full advantages but still need you to know the profounding knowlege on this.
try this...as a test..
take a simple Contact ejb (as simple as you can make it, just a name and email address). In the ejb-jar.xml set up a role, for example, user, and restrict the access to only this role for all methods.
try to access the ejb from a jsp, and you should get the login form identified in your web.xml file.
make sure that the ejb is noted in the web.xml file, also.
this should work...
no try this...identify a role in your web.xml file, (user, for example) and restrict the access to the a particular jsp which is not calling the ejb. IF you navigate to this jsp, you should get the login prompt...
this should work....
now the tough part
in your application.xml create a role with the same name, user. By doing this, you have created a global role, and connect the two together.
...
Now point your browser to the restricted jsp with no calls to the ejb...you should get the login, so login in.
now navigate to your jsp which is unrestricted, but calls the restricted ejb...
there should now be no login prompt.
This should work.