Merge pull request #25290 from OndroMih/ondromih-fix-25141-random-403

Fix random 403 responses

nucleus/security/core/src/main/java/com/sun/enterprise/security/SecurityContext.java

@@ -75,7 +75,7 @@ public class SecurityContext extends AbstractSecurityContext {
     // Did the client log in as or did the server generate the context
     private boolean serverGeneratedSecurityContext;
 
-    private Principal sessionPrincipal;
+    private final ThreadLocal<Principal> sessionPrincipal = new ThreadLocal<>();
 
     /*
      * This creates a new SecurityContext object. Note: that the docs for Subject state that the internal sets (eg. the
@@ -370,11 +370,15 @@ public String toString() {
     }
 
     public Principal getSessionPrincipal() {
-        return sessionPrincipal;
+        return sessionPrincipal.get();
     }
 
     public void setSessionPrincipal(Principal sessionPrincipal) {
-        this.sessionPrincipal = sessionPrincipal;
+        if (sessionPrincipal != null) {
+            this.sessionPrincipal.set(sessionPrincipal);
+        } else {
+            this.sessionPrincipal.remove();
+        }
     }
 
     public Set<Principal> getPrincipalSet() {