title: HTTP basic authentication for JAX-RS without web.xml
body: <p>I'm implementing a REST service within an EJB-JAR within an EAR running on the JBoss EAP 7.1.</p>
  
  <p>The unsecured version of the service works fine, but adding even basic HTTP-authentication turned out to be a challenge, since within an EJB-JAR I found no way to specify any required web.xml-entries, like <code>&lt;auth-method&gt;BASIC&lt;/auth-method&gt;</code></p>
  
  <p>So my question is:</p>
  
  <h3>How can I configure JAX-RS to use HTTP authentication within an EJB-JAR?</h3>
  
  <p>Additional information:</p>
  
  <ul>
  <li><p>To make things simpler I use default ManagementRealm like this</p>
  
  <pre><code>&lt;security-domain name="my-security-domain" cache-type="default"&gt;
      &lt;authentication&gt;
          &lt;login-module code="Remoting" flag="optional"&gt;
              &lt;module-option name="password-stacking" value="useFirstPass"/&gt;
          &lt;/login-module&gt;
          &lt;login-module code="RealmDirect" flag="required"&gt;
              &lt;module-option name="realm" value="ManagementRealm"/&gt;
          &lt;/login-module&gt;
      &lt;/authentication&gt;
  &lt;/security-domain&gt;
  </code></pre></li>
  <li><p>In EJB-jar:</p>
  
  <pre><code>@Stateless
  @Path("/my-rest")
  @SecurityDomain(value = "my-security-domain")
  @DenyAll
  public class MyRestStatelessBean {
          @PUT
          @RolesAllowed("admin")
          @Path("/doAdminStuff")
          public void doAdminStuff() {
              // Implementation
          }
  }
  </code></pre></li>
  </ul>