Patent ID: 8381278

Claim:
A computer-implemented method, comprising: establishing a security inflow contract between a work-initiating system and an application server instance, wherein the security inflow contract enables a connector between the work-initiating system and the application server instance to submit work to the application server instance for execution and to deliver messages to message endpoints of the application server instance in the context of a caller identity, wherein said establishing the security inflow contract comprises: receiving, from the work-initiating system at the connector between the work-initiating system and the application server instance, an indication of one or more tasks to be performed by the application server instance and caller principal information corresponding to the one or more tasks, wherein the caller principal information includes identity information for a caller principal; implementing, by the connector, a security inflow context object for the one or more tasks; generating, by the connector, a work instance comprising an indication of the one or more tasks, wherein the work instance further indicates the security inflow context object for the one or more tasks; sending the work instance to the application server instance; receiving, by the connector from the application server instance, a reference to a callback handler of the application server instance in response to the application server instance detecting the security inflow context object for the one or more tasks and invoking a procedure for providing the callback handler as indicated in the security inflow context object; and invoking, by the connector, one or more callbacks supported by the referenced callback handler to establish, via the callback handler, the caller identity for the work instance on the application server instance according to the caller principal information, wherein the caller identity indicates a security context for the work instance on the application server instance; and performing, by the application server instance, the one or more tasks indicated by the work instance under the established caller identity and within the indicated security context.