While playing around with MDB's and its 'run-as' configuration we found out that the public void ejbCreate() method is not called in the security context of a configured run-as principal. It would be nice when in the ejbCreate method references to other beans (e.g stateless session beans) could be initialized which are running in a security domain (=they need at least a known principal).

I couldn't find something about this topic in the EJB 2.1 specification (section 15.4.5), but I think this is a useful usecase and it would be a nice feature in JBoss.