title: SecurityContext doesn't work with @RolesAllowed
body: <p>I'm currently creating a backend server using Jersey 2.5.1 in a Tomcat 7. For the security I'm using the <code>@RolesAllowed</code>, <code>@PermitAll</code> etc. annotations, and I have created my custom <code>ContainerRequestFilter</code> and <code>SecurityContext</code>.</p>
  
  <p>My problem is that when my <code>@RolesAllowed</code> annotated resource is requested it always denies permission, even if I force my <code>isUserInRole(role)</code> method to return <code>true</code>. However, my <code>filter</code> method gets called. Do you have any suggestions? I'll paste some relevant code below.</p>
  
  <p>My <code>ContainerRequestFilter</code> implementation:</p>
  
  <pre><code>public class AuthorizationFilter implements ContainerRequestFilter
  {
      @Override
      public void filter(ContainerRequestContext request) throws IOException
      {
          request.setSecurityContext(new Authorizer());
      }
  }
  </code></pre>
  
  <p>My <code>SecurityContext</code> implementation:</p>
  
  <pre><code>public class Authorizer implements SecurityContext
  {
  
      @Override
      public String getAuthenticationScheme() {
          return null;
      }
  
      @Override
      public Principal getUserPrincipal() {
          return null;
      }
  
      @Override
      public boolean isSecure() {
          return false;
      }
  
      @Override
      public boolean isUserInRole(String role) {
          return true;
      }
  
  }
  </code></pre>
  
  <p>My resource:</p>
  
  <pre><code>@Path("/secure")
  public class TestSecureResource {
  
      @GET
      @PermitAll
      @Path("/nonsec_test/{text}")
      public Response nonSecureTest(
              @PathParam("text") String text){
  
          return Response.status(200).entity(text).build();
      }
  
      @GET
      @RolesAllowed("admin")
      @Path("/sec_test/{text}")
      public Response secureTest(
              @PathParam("text") String text){
  
          return Response.status(200).entity(text).build();
      }
  }
  </code></pre>
  
  <p>My <code>ResourceConfig</code>:</p>
  
  <pre><code>@ApplicationPath("/")
  public class MyApplication extends ResourceConfig {
  
      public MyApplication() {
          super(TestSecureResource.class);
          register(RolesAllowedDynamicFeature.class);
          register(AuthorizationFilter.class);
      }
  }
  </code></pre>
  
  <p>Relevant parts of my <code>web.xml</code>:</p>
  
  <pre><code>&lt;servlet-name&gt;Jersey Web Application&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.glassfish.jersey.servlet.ServletContainer&lt;/servlet-class&gt;
  
          &lt;init-param&gt;
              &lt;param-name&gt;jersey.config.server.provider.packages&lt;/param-name&gt;
              &lt;param-value&gt;pkg.backend&lt;/param-value&gt;
          &lt;/init-param&gt;
  
          &lt;init-param&gt;
              &lt;param-name&gt;javax.ws.rs.Application&lt;/param-name&gt;
              &lt;param-value&gt;pkg.backend.MyApplication&lt;/param-value&gt;
          &lt;/init-param&gt;
  
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  </code></pre>
  
  <p>In this specific case, my access to <code>secureTest</code> is always denied. To clarify things; I'm getting HTTP status code 403 - Forbidden.</p>
  
  <p>Thank you guys in advance</p>