It returns a string with the IP address. Stupidity is strictly in the
eye of the beholder.

Well, what's a client? RMI will use a different TCP local port number at
the client end depending on whether it is reusing the same connection or
starting a new one, which it does for reasons hidden under the hood of
RMI. One of those is two threads calling the same server at the same
time. This will use two connections, and therefore two ports. Is that
one client, or two? What about two independent applications in the same
JVM? is that one client or two? What about two JVMs in the same client
host? What about a single thread in a single thread which makes two
calls an hour apart which use two separate connections and therefore two
port numbers? Is that really two clients?

All in all I think identifying clients with IP addresses is as sensible
as anything. Qualifying them by port number as well is pretty meaningless.

Take a look at the class ThreadLocal. You can declare a
ThreadLocal<User> inside the server and then on every server call, you
call a method like:

public void setAccessUser(User user)
{
 localThread.set(user);
}

and specify who is calling.