title: JAX-RS security - principal not persisting
body: <p>First the code:</p>
  
  <p>Application setting class:</p>
  
  <pre><code>    @ApplicationPath("/rest")
      public class ApplicationConfig extends Application {
  
      }
  </code></pre>
  
  <p>JAX-RS resource class:</p>
  
  <pre><code>    @Path("/test")
      @RequestScoped
      public class TestWS {
          @POST
          @Path("/login")
          @Produces(MediaType.TEXT_PLAIN)
          public Response login(@Context HttpServletRequest req){
              req.getSession().setAttribute("test","test");
              System.out.println(req.getSession().getId());
              if(req.getUserPrincipal() == null){
                  String authHeader = req.getHeader(HttpHeaders.AUTHORIZATION);
                  if(authHeader != null &amp;&amp; !authHeader.isEmpty()){
                      String base64Credentials = authHeader.substring("Basic".length()).trim();
                      String credentials = new String(Base64.getDecoder().decode(base64Credentials),
                              Charset.forName("UTF-8"));
                      final String[] values = credentials.split(":",2);
                      try {
                          req.login(values[0], values[1]);
                          System.out.println(req.getUserPrincipal().toString());
                      }
                      catch(ServletException e){
                          e.printStackTrace();
                          return Response.status(Response.Status.UNAUTHORIZED).build();
                      }
                  }
              }else{
                  System.out.println(req.getUserPrincipal());
                  System.out.println(req.isUserInRole("User"));
                  req.getServletContext().log("Skipped logged because already logged in!");
              }
  
              req.getServletContext().log("Authentication Demo: successfully retrieved User Profile!");
              return Response.ok().build();
          }
  
          @Path("/ping")
          @Produces(MediaType.APPLICATION_JSON)
          @GET
          public String ping(@Context HttpServletRequest req){
              Object test = req.getSession().getAttribute("test");
              System.out.println(req.getSession().getId());
              System.out.println(test);
              System.out.println(req.getUserPrincipal());
              System.out.println(req.isUserInRole("User"));
              return "{\"status\":\"ok\"}";
          }
      }
  </code></pre>
  
  <p>web.xml:</p>
  
  <pre><code>    &lt;?xml version="1.0" encoding="UTF-8" ?&gt;
      &lt;web-app&gt;
          &lt;context-param&gt;
              &lt;param-name&gt;resteasy.role.based.security&lt;/param-name&gt;
              &lt;param-value&gt;true&lt;/param-value&gt;
          &lt;/context-param&gt;
  
          &lt;security-constraint&gt;
              &lt;web-resource-collection&gt;
                  &lt;web-resource-name&gt;rest&lt;/web-resource-name&gt;
                  &lt;url-pattern&gt;/rest/*&lt;/url-pattern&gt;
                  &lt;http-method&gt;GET&lt;/http-method&gt;
                  &lt;http-method&gt;POST&lt;/http-method&gt;
                  &lt;http-method&gt;PUT&lt;/http-method&gt;
                  &lt;http-method&gt;DELETE&lt;/http-method&gt;
              &lt;/web-resource-collection&gt;
              &lt;user-data-constraint&gt;
                  &lt;transport-guarantee&gt;NONE&lt;/transport-guarantee&gt;
              &lt;/user-data-constraint&gt;
          &lt;/security-constraint&gt;
  
          &lt;welcome-file-list&gt;
              &lt;welcome-file&gt;index.html&lt;/welcome-file&gt;
          &lt;/welcome-file-list&gt;
  
          &lt;session-config&gt;
              &lt;session-timeout&gt;30&lt;/session-timeout&gt;
          &lt;/session-config&gt;
  
          &lt;login-config&gt;
              &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
              &lt;realm-name&gt;PBKDF2DatabaseDomain&lt;/realm-name&gt;
          &lt;/login-config&gt;
      &lt;/web-app&gt;
  </code></pre>
  
  <p>jboss-web.xml</p>
  
  <pre><code>    &lt;?xml version="1.0" encoding="UTF-8"?&gt;
      &lt;jboss-web&gt;
          &lt;context-root&gt;/&lt;/context-root&gt;
          &lt;security-domain&gt;PBKDF2DatabaseDomain&lt;/security-domain&gt;
      &lt;/jboss-web&gt;
  </code></pre>
  
  <p>security settings in standalone.xml</p>
  
  <pre><code>    &lt;subsystem xmlns="urn:jboss:domain:security:1.2"&gt;
          &lt;security-domains&gt;
              &lt;security-domain name="PBKDF2DatabaseDomain" cache-type="default"&gt;
                  &lt;authentication&gt;
                      &lt;login-module code="de.rtner.security.auth.spi.SaltedDatabaseServerLoginModule" flag="required" module="de.rtner.PBKDF2"&gt;
                          &lt;module-option name="dsJndiName" value="java:jboss/datasources/developmentDS"/&gt;
                          &lt;module-option name="principalsQuery" value="SELECT password FROM ur.user WHERE username=?"/&gt;
                          &lt;module-option name="rolesQuery" value="select distinct r.NAME, 'Roles' from ur.user_roles ur left join ur.ct_role r on ur.ROLE_ID = r.ID left join ur.user u on ur.USER_ID = u.ID where u.username =?"/&gt;
                      &lt;/login-module&gt;
                  &lt;/authentication&gt;
              &lt;/security-domain&gt;
  ...
  </code></pre>
  
  <p>Now my problem is that after I use /login method with BASIC auth header in request I already get user principal so it prints out:</p>
  
  <p>Skipped logged because already logged in!</p>
  
  <p>And if I remove BASIC auth header from request and I call login again I still get the same print out - so I already have user principal in request - no need to req.login. </p>
  
  <p>BUT if I call ping method user principal is null even tho session id is the same and session attribute is set. What am I doing wrong? I would like that user principal would persist on /ping like it does on /login.</p>
  
  <p>I am using Wildfly 10 (RESTeasy jax-rs implementation)</p>
  
  <p>My question is similalr to:
  <a href="https://stackoverflow.com/questions/17202398/jboss-as7-jax-rs-jaas-and-annotations">JBOSS AS7 jax-rs jaas and annotations</a></p>
  
  <p>But the fix - setting session attribute in login method didn't work for me.</p>