So how does an organization monitor SOA Database or data transactions. (Those transactions initiated by a SOA Session?) The SOA authentication piece I understand the missing link for me is how if a server initiates a session (JNDI, XAI) for an authenticated user as another pseudo or the session bean is initiating database tranactions for the end user how is security supposed to monitor who or what initiated these database reads writes etc..

Does the e-Security product from Novell monitor these actions from and end user perspective or are there other products that could aggregate this data back to the authenticated user or his or her session for logging?