There is no setter method for the security domain property in the SecurityContext, which prevents the domain from being updated when different containers use different domains (e.g. the Web container may use a security domain and call ejbs that use another security domain - the context security domain must be updated in the ejb container so that the appropriate modules are called).