# Propagating User Identity Chains Across JVM Service Calls

DevFeed: [Propagating User Identity Chains Across JVM Service Calls](<https://devfeed.tech/articles/security-baked-into-the-jvm-sixteen-subjects-on-the-wire-18931.md>)

Original publisher: [Read original article](<https://blog.frankel.ch/security-baked-into-jvm/4/>)

Author: Peter Firmstone

Published: 2026-08-23T00:00:00Z

Content type: article

Language: en

Sources: [Nicolas Fränkel](<https://devfeed.tech/sources/nicolas-frankel.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Java](<https://devfeed.tech/topics/java.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>)

Tags: [authorization](<https://devfeed.tech/tags/authorization.md>), [dirtychai](<https://devfeed.tech/tags/dirtychai.md>), [java](<https://devfeed.tech/tags/java.md>), [jgdms](<https://devfeed.tech/tags/jgdms.md>), [jini](<https://devfeed.tech/tags/jini.md>), [jvm](<https://devfeed.tech/tags/jvm.md>), [microservices](<https://devfeed.tech/tags/microservices.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [security](<https://devfeed.tech/tags/security.md>), [technical](<https://devfeed.tech/tags/technical.md>), [tls](<https://devfeed.tech/tags/tls.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

## AI overview

This article explains how a chain of user identities crosses service calls on the wire. It distinguishes TLS machine authentication from in-band user claims, describes receiver-side limits and principal handling, and notes that standard Java 24 lacks the required authorization support without DirtyChai on both ends.

## Source excerpt

Alice calls the order service. The order service calls the ledger on her behalf. At the second hop, the ledger has to decide whose authority the debit is being made under. Most stacks answer badly. Forward Alice's bearer token verbatim, and the ledger cannot tell her from the service that relayed it. Drop the token and the ledger sees a machine, with no record that a human started the chain. Neither option lets the ledger authorize the combination.