webservices/server-integration/src/main/java/org/jboss/as/webservices/tomcat/AbstractSecurityMetaDataAccessorEJB.java
public String getSecurityDomain(final Deployment dep) {
        String securityDomain = null;

        for (final EJBEndpoint ejbEndpoint : getEjbEndpoints(dep)) {
            String nextSecurityDomain = ejbEndpoint.getSecurityDomain();
            if (nextSecurityDomain == null || nextSecurityDomain.isEmpty()) {
                nextSecurityDomain = null;
            }
            securityDomain = getDomain(securityDomain, nextSecurityDomain);
        }

        if (securityDomain == null) {
            final DeploymentUnit unit = WSHelper.getRequiredAttachment(dep, DeploymentUnit.class);
            if (unit.getParent() != null) {
                final EarMetaData jbossAppMD = unit.getParent().getAttachment(Attachments.EAR_METADATA);
                return jbossAppMD instanceof JBossAppMetaData ? ((JBossAppMetaData)jbossAppMD).getSecurityDomain() : null;
            }
        }

        return securityDomain;
    }
public String getSecurityDomain(final Deployment dep) {
        String securityDomain = null;

        for (final EJBEndpoint ejbEndpoint : getEjbEndpoints(dep)) {
            String nextSecurityDomain = ejbEndpoint.getSecurityDomain();
            if (nextSecurityDomain == null || nextSecurityDomain.isEmpty()) {
                nextSecurityDomain = null;
            }
            securityDomain = getDomain(securityDomain, nextSecurityDomain);
        }

        if (securityDomain == null) {
            final DeploymentUnit unit = WSHelper.getRequiredAttachment(dep, DeploymentUnit.class);
            if (unit.getParent() != null) {
                final EarMetaData jbossAppMD = unit.getParent().getAttachment(Attachments.EAR_METADATA);
                return jbossAppMD instanceof JBossAppMetaData ? ((JBossAppMetaData)jbossAppMD).getSecurityDomain() : null;
            }
        }

        return securityDomain;
    }
@see org.jboss.webservices.integration.tomcat.AbstractSecurityMetaDataAccessorEJB#getSecurityDomain(Deployment)

@param dep webservice deployment
@return security domain associated with EJB 3 deployment