Fix for SEC-111. Added a try/finally block to make sure context is always reset after the invocation.

core/src/main/java/org/acegisecurity/context/rmi/ContextPropagatingRemoteInvocation.java

@@ -117,15 +117,18 @@ public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
                 + securityContext);
         }
 
-        Object result = super.invoke(targetObject);
+        try {
 
-        SecurityContextHolder.setContext(new SecurityContextImpl());
+            return super.invoke(targetObject);
 
-        if (logger.isDebugEnabled()) {
+        } finally {
-            logger.debug(
+
-                "Set SecurityContext to new instance of SecurityContextImpl");
+            SecurityContextHolder.setContext(new SecurityContextImpl());
+
+            if (logger.isDebugEnabled()) {
+                logger.debug(
+                    "Set SecurityContext to new instance of SecurityContextImpl");
+            }
         }
-
-        return result;
     }
 }

core/src/test/java/org/acegisecurity/context/rmi/ContextPropagatingRemoteInvocationTests.java

@@ -85,6 +85,28 @@ public class ContextPropagatingRemoteInvocationTests extends TestCase {
             remoteInvocation.invoke(new TargetObject()));
     }
 
+    public void testContextIsResetEvenIfExceptionOccurs() throws Exception {
+        // Setup client-side context
+        Authentication clientSideAuthentication = new UsernamePasswordAuthenticationToken("marissa",
+                "koala");
+        SecurityContextHolder.getContext().setAuthentication(clientSideAuthentication);
+
+        ContextPropagatingRemoteInvocation remoteInvocation = getRemoteInvocation();
+
+        try {
+            // Set up the wrong arguments.
+            remoteInvocation.setArguments(new Object[] {});
+            remoteInvocation.invoke(TargetObject.class.newInstance());
+            fail("Expected IllegalArgumentException");
+        } catch(IllegalArgumentException e) {
+            // expected
+        }
+
+        assertNull("Authentication must be null ", SecurityContextHolder.getContext().getAuthentication());
+
+    }
+
+
     private ContextPropagatingRemoteInvocation getRemoteInvocation()
         throws Exception {
         Class clazz = TargetObject.class;