Since JPA 2.0 does not support injection into EntityListener (JPA 2.1 will), decided to use JNDI lookup to get the BeanManager
and through it get the logged in
Your approach is correct.
Performance throughput?
IMHO no need to worry - JPA 2.1 will use an equivalent mechanism. But make sure to write a realistic test to be on the safe side.
What happens when there are multiple logged in users updating entities concurrently in their own scopes?
All (non-dependend-scoped) bean references are proxied internally. The underlaying CDI-implementation has to guarantee the correct resolution.