When I throw an instance of java.security.InvalidKeyException in a business method of a stateless session bean. The remote interface will throw an java.rmi.AccessException.

I have studied the EJB Specification 2.1 and cannot found any descriptions about the this kind of Exception translation. By the general Exception handling rule, an application exception an exception which is not direct or indirect subclass of java.lang.RuntimeException and not direct or indirect subclass of java.rmi.RemoteException. Therefore I think java.security.InvalidKeyException should be counted as an application exception.

I have studied the security session of the EJB Spec 2.1 and there are no hints about this kind of exception translation.

However, from the jboss source code, I figure out this exception translation is intended to enforce. I think this is a bug that violates the EJB specification.