SLSB is single-threaded due to the context of TX, Principal is associated with the bean instance when it is called. These beans are combined even if the maximum pool size is not processed in separate threads (depending on the provider).
If SLSBs were designed to be thread safe, each call will look like a doGet / Post servlet with request information containing Tx Context, security content information, etc. That way, at least the code looks clean (developer dependent).
Alexander Stolz
source share