title: Securing EJBs with Apache Shiro possible?
body: <p>I want to know if I can use Apache Shiro to secure the business tier of an (container managed) Java EE application. I'm asking because I haven't found any examples but only statements like "it works in web, EJB, and IoC environments".</p>
  
  <p>Apache Shiro, in comparison with the default Java role-based access control, seams to have more extensive ways to authorize users (e.g. permission strings), which I hope one can use as a replacement to secure the methods of session beans in an annotation based manner.</p>
  
  <p>Is this possible and has anyone tried it? Are there restrictions?  An example or tutorial would be nice, too.</p>