title: EJB JAX-WS Web Service authentication and authorization
body: <p>How can I authenticate with HTTP Basic, via the application server domain/secure realm, using a Session Bean published as a <code>@WebService</code>?</p>
  
  <p>In a Web project one could use <code>web.xml</code> to map Roles to Groups, but I have no idea how to do it in a EJB-JAR project. I don't think it can be done with <code>ejb-jar.xml</code>.</p>
  
  <p>Sample code, which works fine without the roles annotations:</p>
  
  <pre><code>@Stateless
  @WebService(portName="RestrictedServicePort")
  @DeclareRoles(value = "Administrators")
  public class RestrictedServiceBean {
  
      @RolesAllowed(value = "Administrators")
      public String restrictedOperation() {
          return "Secret information";        
      }
  
  }
  </code></pre>
  
  <p>Error:</p>
  
  <pre><code>&lt;faultstring&gt;[EJB:010160]Security Violation: User: '&amp;lt;anonymous&gt;' has insufficient permission to access EJB: type=&amp;lt;ejb&gt;
  </code></pre>
  
  <p>Basic Credentials Header:</p>
  
  <p><code>Authorization: Basic d2VibG9naWM6d2VsY29tZTE=</code></p>
  
  <p>I suspect it must be done via vendor-specific configuration. I am using WebLogic 10.3.6, Java EE 5 / EJB 3.0.</p>