title: Java + Microprofile - How to authenticate without authorization
body: <p>Technology stack:</p>
  <ul>
  <li>payara micro 5.2021.1</li>
  <li>jakarta 8</li>
  <li>microprofile 4.1</li>
  </ul>
  <p>I'm trying to create a simple microservice with authentication in place. I created a simple angular application that only uses the google API's service with the implicit flow to generate a jwt token.</p>
  <p>Microprofile has a library that can be used for authentication and authorization.
  I tried to use it (microprofile-jwt-auth-api) and I would like to achieve authentication without any kind of authorization.</p>
  <p>For that I'm using the annotation <code>@LoginConfig(authMethod = &quot;MP-JWT&quot;)</code> in the class that extends the <code>Application</code> class, combined with mp.jwt configurations in microprofile.properties.</p>
  <p>Not sure if I'm doing anything wrong, but my expectation was that any call to any resource without the authorization header should retrieve an unauthorized error.</p>
  <p>The authentication seems to not work without the <code>@AllowedRoles</code>. If I add the <code>@AllowedRoles</code> in my controllers, the authentication starts to work. After <em>googling</em>, I got the idea that the <code>@LoginConfig(authMethod = &quot;MP-JWT&quot;)</code> only works combined with the <code>@AllowedRoles</code>, which seems to be strange to me...</p>
  <p>Also, it seems that it is possible to disable the allowed roles mechanism (<a href="https://docs.payara.fish/community/docs/5.2020.3/documentation/microprofile/jwt.html#_switching_off_rolesallowed_support_in_jax_rs" rel="nofollow noreferrer">https://docs.payara.fish/community/docs/5.2020.3/documentation/microprofile/jwt.html#_switching_off_rolesallowed_support_in_jax_rs</a>) but it didn't work.</p>
  <p>Do you have any idea? The workaround would be to create a filter and explicitly call the google API to validate and introspect the token, but I want to avoid this scenario (if possible).</p>