Merging stateless and stateless connections

which will open the stateful connection?

Do you mean:

• Open a stateful connection that will remain open between calls to the server and will not be automatically passed on when returned to the client?
• Open a connection using security credentials available from the session context to get a connection to the database user / user?

In the former case, while it may be possible to make use of a StatefulSessionBean (SFSB) in front of a StatelessSessionBean (SLSB), there are probably much better approaches (for example, using a command pattern to collect interactions between remote calls until you are ready to commit).

In the second case, DataSource.lookup (username, password) can help, although your DataSource queries should probably provide username and password sequentially to ensure you get the same connection.

Will this lead to any design / performance issue?

In both cases, you must be very careful not to make basic security mistakes (for example, sending passwords in plain text). I've never taken any approach, and would be inclined to redesign a solution that includes.

I would be concerned about performance issues, not security and other design issues such as fragility in service.