title: JAX-WS webservice and @rolesAllowed
body: <p>Is it possible to use <code>@RolesAllowed</code> annotation on a JAX-WS webservice and if so how?</p>
  
  <p>I have a webservice on glassfish 3.1.1 using Basic Authentication but restrictions expressed using <code>@RolesAllowed</code> are ignored. The role information should be available, as I can access it like this:</p>
  
  <pre><code>@Resource
  WebServiceContext wsContext;
  
  if (wsContext.isUserInRole("READ"))
  log.info("Role: READ");
  </code></pre>
  
  <p>I get the expected role but still all methods are accessible, even if <code>@RolesAllowed</code> is set to different role. <code>@DenyAll</code> is not working as well.</p>
  
  <p>If these annotations are not supported, is it possible to use deployment descriptors to manage access to webservice methods based on user roles?</p>
  
  <p><strong>Edit</strong>:
  <a href="http://docs.oracle.com/javaee/6/tutorial/doc/bnbxj.html#bnbxu">This</a> part of the JAVA EE 6 tutorial describes the usage of <code>@RolesAllowed</code> annotation. It reads</p>
  
  <blockquote>
    <p>For Java EE components, you define security roles using the @DeclareRoles and @RolesAllowed metadata annotations.</p>
  </blockquote>
  
  <p>Web services are not listed as Java EE components in the first part of the tutorial, so it looks like the security annotations are not supported. </p>
  
  <p><strong>Edit2</strong>
  Following Izan's post, I gave this another try. Here is what I did:</p>
  
  <pre><code>@Webservice
  @DeclareRoles(value = {"READ", "UPDATE", "DELETE"})
  public class ServiceImpl implements Service {
    @Override
    @WebMethod(operationName = "helloWorld")
    @RolesAllowed({"NONE"})
    public String helloWorld() throws Exception {
       return "Hello World!";
    }
  }
  </code></pre>
  
  <p>Using this kind of setup, everybody can access the method, no matter what roles are set. Users get authenticated (can see that in audit.log) but no authorization takes place. As stated above, I can access the role from <code>WebServiceContext</code> (I actually do <em>manual</em> authorization using this info). </p>
  
  <p>Adding <code>@Stateless</code> annotation, let's me use the security annotations. So <code>@permitAll</code> works as expected. But using roles still does not work, as user don't get authenticated now. They show up as <code>ANONYMOUS</code> in audit log and access is denied to them.</p>
  
  <p>My <code>web.xml</code> looks like this:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0"&gt;
   &lt;display-name&gt;OneMore&lt;/display-name&gt;
  
   &lt;security-constraint&gt;  
      &lt;display-name&gt;WebServiceSecurity&lt;/display-name&gt;  
  
      &lt;web-resource-collection&gt;  
        &lt;web-resource-name&gt;Authorized users only&lt;/web-resource-name&gt;  
        &lt;url-pattern&gt;/service&lt;/url-pattern&gt;  
        &lt;http-method&gt;POST&lt;/http-method&gt;
      &lt;/web-resource-collection&gt;  
  
      &lt;auth-constraint&gt;       
         &lt;role-name&gt;READ&lt;/role-name&gt;
         &lt;role-name&gt;UPDATE&lt;/role-name&gt;
         &lt;role-name&gt;DELETE&lt;/role-name&gt;
      &lt;/auth-constraint&gt;  
  
   &lt;/security-constraint&gt;  
  
   &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
   &lt;/login-config&gt;
  
   &lt;security-role&gt;
      &lt;role-name&gt;READ&lt;/role-name&gt;
   &lt;/security-role&gt;
  
   &lt;security-role&gt;
      &lt;role-name&gt;UPDATE&lt;/role-name&gt;
   &lt;/security-role&gt;
  
   &lt;security-role&gt;
      &lt;role-name&gt;DELETE&lt;/role-name&gt;
   &lt;/security-role&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p><code>Glassfish-web.xml</code> just maps role names to group names, like this:</p>
  
  <pre><code>&lt;security-role-mapping&gt;
     &lt;role-name&gt;READ&lt;/role-name&gt;
     &lt;group-name&gt;READ&lt;/group-name&gt;
  &lt;/security-role-mapping&gt;
  </code></pre>
  
  <p><strong>Edit 3</strong>
  Thanks to Izan and countless tries later I finally got it working.</p>
  
  <p>As said before, the main point was switching from a plain web service to an EJB web service by adding <code>@Stateless</code> annotation. This allows for using the security annotations.</p>
  
  <p>This change required to change the deployment descriptors as well. While the original web service required a <code>glassfish-web.xml</code> for setting up the roles, a <code>glassfish-ejb-jar.xml</code> is required afterwards. </p>