title: Java EE Security - personal user's data visible only for him
body: <p>I am just learning Java EE and have encountered on a problem connected with security. Java EE has realms,users,roles and that is all. If current user has the required role to be authorized - he is, anotherwise he fails. My problem is - how to make java ee security to obey such a security constraint - personal user's data is visible only for him. Theoretically, I could make for every user his "role" and programmatically  check if user has role of the user owning that data. It seems for me to be very inconvenient solution (many, many roles). Is Java EE Security capable to deal with such a security constraint as in title?</p>