There are legacy constructs such as the invoker serlvet which create servlets which do not have web.xml metadata configuration that result in the RunAsListener failing with an NPE. It should simply be treating the absence of metadata as the absence of a run-as identity and do nothing.