Source:
<code>public SecurityIdentity createRunAsIdentity(String name, boolean authorize) throws AuthorizationException { Assert.checkNotNullParam("name", name); final SecurityDomain domain = this.securityDomain; name = domain.getPreRealmRewriter().rewriteName(name); if (name == null) { throw log.invalidName(); } String realmName = domain.mapRealmName(name, null, null); Principal principal = new NamePrincipal(name); if (this.principal.equals(principal)) { return this; } RealmInfo realmInfo = domain.getRealmInfo(realmName); name = domain.getPostRealmRewriter().rewriteName(name); if (name == null) { throw log.invalidName(); } name = realmInfo.getNameRewriter().rewriteName(name); if (name == null) { throw log.invalidName(); } if (authorize) { final RunAsPrincipalPermission permission = new RunAsPrincipalPermission(name); if (! getPermissions().implies(permission)) { SecurityRealm.safeHandleRealmEvent(realmInfo.getSecurityRealm(), new RealmIdentityFailedAuthorizationEvent(authorizationIdentity, this.principal, principal)); throw log.unauthorizedRunAs(this.principal, principal, permission); } } else { <START> final SecurityManager sm = System.getSecurityManager(); <END> if (sm != null) { try { sm.checkPermission(SET_RUN_AS_PERMISSION); } catch (SecurityException ex) { SecurityRealm.safeHandleRealmEvent(realmInfo.getSecurityRealm(), new RealmIdentityFailedAuthorizationEvent(authorizationIdentity, this.principal, principal)); throw log.unauthorizedRunAs(this.principal, principal, SET_RUN_AS_PERMISSION); } } } try { final SecurityRealm securityRealm = realmInfo.getSecurityRealm(); final RealmIdentity realmIdentity = securityRealm.getRealmIdentity(name, null, null); final AuthorizationIdentity newAuthorizationIdentity = realmIdentity.getAuthorizationIdentity(); SecurityRealm.safeHandleRealmEvent(securityRealm, new RealmIdentitySuccessfulAuthorizationEvent(this.authorizationIdentity, this.principal, principal)); try { return new SecurityIdentity(domain, principal, realmInfo, newAuthorizationIdentity, roleMappers); } finally { realmIdentity.dispose(); } } catch (RealmUnavailableException ex) { throw log.runAsAuthorizationFailed(this.principal, principal, ex); } }</code><technical_language>I this permission check run regardless</technical_language>

Target:
public SecurityIdentity createRunAsIdentity(String name, boolean authorize) throws SecurityException { Assert.checkNotNullParam("name", name); final SecurityDomain domain = this.securityDomain; name = domain.getPreRealmRewriter().rewriteName(name); if (name == null) { throw log.invalidName(); } String realmName = domain.mapRealmName(name, null, null); Principal principal = new NamePrincipal(name); if (this.principal.equals(principal)) { return this; } RealmInfo realmInfo = domain.getRealmInfo(realmName); name = domain.getPostRealmRewriter().rewriteName(name); if (name == null) { throw log.invalidName(); } name = realmInfo.getNameRewriter().rewriteName(name); if (name == null) { throw log.invalidName(); } if (authorize) { final RunAsPrincipalPermission permission = new RunAsPrincipalPermission(name); if (! getPermissions().implies(permission)) { SecurityRealm.safeHandleRealmEvent(realmInfo.getSecurityRealm(), new RealmIdentityFailedAuthorizationEvent(authorizationIdentity, this.principal, principal)); throw log.unauthorizedRunAs(this.principal, principal, permission); } } final SecurityManager sm = System.getSecurityManager(); if (sm != null) { sm.checkPermission(SET_RUN_AS_PERMISSION); } try { final SecurityRealm securityRealm = realmInfo.getSecurityRealm(); final RealmIdentity realmIdentity = securityRealm.getRealmIdentity(name, null, null); final AuthorizationIdentity newAuthorizationIdentity = realmIdentity.getAuthorizationIdentity(); SecurityRealm.safeHandleRealmEvent(securityRealm, new RealmIdentitySuccessfulAuthorizationEvent(this.authorizationIdentity, this.principal, principal)); try { return new SecurityIdentity(domain, principal, realmInfo, newAuthorizationIdentity, roleMappers); } finally { realmIdentity.dispose(); } } catch (RealmUnavailableException ex) { throw log.runAsAuthorizationFailed(this.principal, principal, ex); } }