Fix for SEC-111. Added a try/finally block to make sure context is always reset after the invocation.

core/src/main/java/org/acegisecurity/context/rmi/ContextPropagatingRemoteInvocation.java

@@ -117,7 +117,11 @@ public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
                 + securityContext);
         }
 
-        Object result = super.invoke(targetObject);
+        try {
+
+            return super.invoke(targetObject);
+
+        } finally {
 
             SecurityContextHolder.setContext(new SecurityContextImpl());
 
@@ -125,7 +129,6 @@ public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
                 logger.debug(
                     "Set SecurityContext to new instance of SecurityContextImpl");
             }
-
+        }
-        return result;
     }
 }

core/src/test/java/org/acegisecurity/context/rmi/ContextPropagatingRemoteInvocationTests.java

@@ -85,6 +85,28 @@ public class ContextPropagatingRemoteInvocationTests extends TestCase {
             remoteInvocation.invoke(new TargetObject()));
     }
 
+    public void testContextIsResetEvenIfExceptionOccurs() throws Exception {
+        // Setup client-side context
+        Authentication clientSideAuthentication = new UsernamePasswordAuthenticationToken("marissa",
+                "koala");
+        SecurityContextHolder.getContext().setAuthentication(clientSideAuthentication);
+
+        ContextPropagatingRemoteInvocation remoteInvocation = getRemoteInvocation();
+
+        try {
+            // Set up the wrong arguments.
+            remoteInvocation.setArguments(new Object[] {});
+            remoteInvocation.invoke(TargetObject.class.newInstance());
+            fail("Expected IllegalArgumentException");
+        } catch(IllegalArgumentException e) {
+            // expected
+        }
+
+        assertNull("Authentication must be null ", SecurityContextHolder.getContext().getAuthentication());
+
+    }
+
+
     private ContextPropagatingRemoteInvocation getRemoteInvocation()
         throws Exception {
         Class clazz = TargetObject.class;