Opened from RHQ-1030...
Basically, the JBoss JNP context factory is storing principal and credentials in thread-locals so that we can have two stubs to different AS instances that require different principal/credentials. I tried jnp.restoreLoginIdentity and jnp.multi-threaded, but that will only let you support different connections in different threads.
After some testing, it looks like we can just have EMS setup the SecurityAssociation before every call into the stub. It should be fairly easy since EMS uses dynamic proxies around the stubs.