title: How to configure security restrictions for EJB methods in TomEE?
body: <p>Basically, I can't get @RolesAllowed annotation to work. It seems that the container completely ignores it.</p>
  
  <p>However, isCallerInRole() method works correctly.</p>
  
  <p>Only admins should be able to call the method below, but the method gets called every time, despite the fact that the user has only a "guest" role.</p>
  
  <pre><code>@Remote
  public interface SomeManager {
      void performImportantTask();
  }
  
  @Stateless
  @DeclareRoles({"guest", "admin"})
  public class SomeManagerBean implements SomeManager {    
      @Resource private EJBContext context;
  
      @RolesAllowed({"admin"})
      @Override public void performImportantTask() {
          logger.info(context.getCallerPrincipal().getName()); // prints the correct user name
  
          if (context.isCallerInRole("admin")) {
              logger.info("Is admin"); // doesn't print
          }
  
          if (context.isCallerInRole("guest")) {
              logger.info("Is guest"); // prints
          }
      }
  }
  </code></pre>
  
  <p>Why is this method called, even though the container is clearly aware that the user is not admin?</p>
  
  <p>I also tried to replace @RolesAllowed with @DenyAll and this denies nothing - the method still executes.</p>
  
  <p>This is the realm configuration in server.xml:</p>
  
  <pre><code>...
              &lt;Realm className="org.apache.catalina.realm.LockOutRealm"&gt;
                  &lt;Realm className="org.apache.catalina.realm.DataSourceRealm"
                         dataSourceName="securityDS"
                         userTable="users"
                         userNameCol="user_name"
                         userCredCol="user_pass"
                         userRoleTable="user_roles"
                         roleNameCol="role_name"/&gt;
              &lt;/Realm&gt;
              ...            
          &lt;/Engine&gt;
      &lt;/Service&gt;
  &lt;/Server&gt;
  </code></pre>
  
  <p>Most likely, I have some configuration problem, but I don't know where else to look. 
  Or maybe I have some misconception here?</p>
  
  <p>I assume that tomcat_users.xml file has nothing to do with DataSourceRealm. 
  Still, thinking that I maybe need to define the roles in this file, I added them like this:</p>
  
  <pre><code>&lt;tomcat-users ...&gt;
    &lt;role rolename="admin"/&gt;
    &lt;role rolename="guest"/&gt;
  &lt;/tomcat-users&gt;
  </code></pre>
  
  <p>But this didn't change anything in the above scenario.</p>
  
  <p>Relevant documentation:</p>
  
  <p><a href="http://tomee.apache.org/security-annotations.html" rel="nofollow noreferrer">TomEE Security Annotations</a></p>
  
  <p><a href="http://tomee.apache.org/examples-trunk/realm-in-tomee/" rel="nofollow noreferrer">DataSourceRealm and TomEE DataSource</a></p>