Service-based security with Java EE <p>All Java EE authorisation techniques I've seen so far are for the view layer only - mostly based on JSF. You basically restrict access to certain URL patterns or JSF components.</p> <p>However, I'd prefer to have my security layer on the services. My layers are looking something like this:</p> <ul> <li>View (XHTML + JSF Backing Beans / RESTful web services)</li> <li>Services</li> <li>Entities and Business Logic</li> <li>DAOs</li> </ul> <p>Since the services are a proxy to my business logic and contain no logic by themselves, I'd like to use them for access control. This way I wouldn't need to implement the security for each view technology separately or watch out for URL patterns (which are terrible to maintain).</p> <p>My preferred solution would be annotations for classes or methods on the services. If some view code tries to access them without permission, it gets an exception (which is handled and should forward to a login form).</p> <p>Is there anything like this I could use?</p>