Index: oak-core/src/main/java/org/apache/jackrabbit/oak/security/authentication/LoginContextProviderImpl.java
===================================================================
--- oak-core/src/main/java/org/apache/jackrabbit/oak/security/authentication/LoginContextProviderImpl.java	(Revision 1869978)
+++ oak-core/src/main/java/org/apache/jackrabbit/oak/security/authentication/LoginContextProviderImpl.java	(Arbeitskopie)
@@ -78,11 +78,11 @@
             throws LoginException {
         Subject subject = getSubject();
         if (subject != null && credentials == null) {
+            //TODO verify that this subject is in fact pre-authenticated by Oak
             log.debug("Found pre-authenticated subject: No further login actions required.");
             return new PreAuthContext(subject);
         }
-
-        if (subject == null) {
+        if (subject == null || subject.isReadOnly()) {
             subject = new Subject();
         }
         CallbackHandler handler = getCallbackHandler(credentials, workspaceName);