EJB call from one domain to another, authentication problem

Question

Two Weblogic servers. WLS A and WLS B. Different domains. Trust relationship between the domains can't be established.
I have an EJB in WLS B and there is a Web Application deployed to WLS A. There are method-permission declarations in the EJB descriptor xml.
Step 1. User authenticates to Servlet in Web Application (WLS A). Authentication is done with Http Basic Authentication.
Step 2. Servlet makes a JNDI lookup to get a handle to the EJB. Handle can not be fetched with the authentication information which was provided by user to servlet. This means that I need to specify a different username and password, which should be used for authentication at WLS B.
Step 3. After getting a handle to the EJB Servlet calls a method of the EJB.
Everything seems extremely simple. And it should be. But no.
At step 2 servlet propagates authentication information from WLS A to WLS B. This authentication information is valid only inside WLS A, not in WLS B. Result: SecurityException: Invalid Subject.
Setting SECURITY_PRINCIPAL and SECURITY_CREDENTIALS to InitialContext while creating it still results in propagation of authentication information. Same exception.
So I tried something else.
Tthe code doing the JNDI lookups and EJB calls was wrapped inside Security.runAs(new Subject(), ....) -block. Authentication information is no longer propagated to WLS B. So JNDI lookup succeeds, excellent!
But we only got one step further. Now we still need to make the call to EJB method at step 3.
Now that EJB method call results in Security Violation: User: <anonymous> has insufficient permission to access my method.
It's a bit strange, because username and password (for WLS B) were provided for InitialContext while creating it. If the password is invalid, the InitialContext can't be created. So it seems that atleast the username and password ARE checked at WLS B.
Any help and/or suggestions would be highly appreciated.
Here is a misc list of some misc wondering:
-Step 2. Should we make the JNDI lookup to JNDI tree of WLS A instead of WLS B. If we do so, then we should use ejb-ref's at web.xml. This was also quickly tested with no results.
-Would run-as-identity (or some similar element) help? Maybe we could set up some Credential Mapper to WLS A, which would provide username/password when making calls to EJB's of WLS B. Documentation about Credential Mappers seems to be quite useless.

Answer 1

There was a time, and it was quite some time ago when something similar was tried and it didn't meet with much success. Sure, it may not have been Domain files, it may have been something more like, say, rocks, but the general principle still applies. If you look at the XML and media parts that make up a Domain file, you can think of those pieces as analogous to the atoms in your average run-of-the-mill rock. Though the atoms in two given average run-of-the-mill rocks may seem quite similar, and cracking them open reveals innards that are almost entirely, but not quite, the same, it's still quite difficult to make one whole rock out of the two.
Now, some say alchemists might be able to accomplish this quite daunting task, but, until a study of use for Domain files (perhaps XMLchemy?) is initiated and studied most earnestly, we shall probably remain unable to bring about the union of one Domain file and another. Or were we talking about the rocks? (You can't melt Domain files, can you? The thought just hit me is all...)
How's that for a long answer?