title: Authentication of user through the Application client container in GlassFish is too ambitious?
body: <h3>Problem</h3>
  
  <p>When I inject an @EJB proxy in the <code>Main</code> class of an application client, and that EJB has a method that require a user to be in a certain role, then the application client container (ACC) will require the user to login as soon as the application client launches. The ACC will not differentiate between what methods the client had in mind calling, thus what roles - if any at all - are actually required of the client to be in. In effect, that means my client cannot hook himself up with the server properly if just one single method of the EJB has a method that require a certain role. It does not matter if we explicitly annotate the EJB with <code>@PermitAll</code>. The ACC will still prompt for username and password, and if not given, then my GlassFish 3.1.2.2 (build 5) implementation will abort everything and say "<em>The user cancelled authentication</em>".</p>
  
  <h3>Setup your test environment!</h3>
  
  <p>Declare a remote interface like so:</p>
  
  <pre><code>@Remote
  public interface IRemoteEJB
  {
  String echoGuest(String returnMe);
  String echoAdmin(String returnMe);
  }
  </code></pre>
  
  <p>Write the EJB (my problem relates to a singleton so I dare not use another session annotation here!):</p>
  
  <pre><code>@Singleton
  /*
   * See the following annotation. We explicitly "permit all" on class level.
   * Should not cause any ambiguity at all!
   */
  @PermitAll
  public class myEJB implements IRemoteEJB
  {
      @Override
      public String echoGuest(String returnMe) {
          return returnMe; }
  
      @Override
      // ..but here we grant access only to administrators:
      @RolesAllowed("admin")
      public String echoAdmin(String returnMe) {
          return returnMe; }
  }
  </code></pre>
  
  <p>As for the client part, here's the smallest possible implementation I could think of:</p>
  
  <pre><code>public class Main
  {
      @EJB private static remoteProxy;
  
      public static void main(String... args)
      {
          String reply = remoteProxy.echoGuest("Hello world!");
          JOptionPane.showMessageDialog(null, reply);
      }
  }
  </code></pre>
  
  <h3>Result</h3>
  
  <p>Do you think that the client successfully makes an "anonymous" call to the <code>echoGuest</code> method? No. I've found that the ACC will force the client to give username and password even before the <code>@EJB</code> is injected. Simply put if, we cannot mix access authentication to an EJB from an application client. The solution above would be to remove the <code>@RolesAllowed("admin")</code> annotation from the <code>echoAdmin</code> method.</p>
  
  <p>In one way, that makes perfectly sense. The ACC is only active during the boot of the client, the very reason why we need to put all injected resources in an application client both in the <code>Main</code> class and make them <code>static</code> too. The ACC simply cannot know exactly which methods in the EJB will be invoked or not.</p>
  
  <p>Okay, but does that not break the specification and expected behavior of the <code>@PermitAll</code> and <code>@RolesAllowed</code> annotations? Is there no way on this earth that we could provide the application client with anonymous access rights to an EJB that has only one obsolete, never invoked, method requiring a certain role? As of now, I have to separate these methods not only with the annotations I thought I could and should have done, but also I have to refactor the logic to completely separate EJB:s. Feels hard :'(</p>