title: Implementing generic JAX-RS web service using javax.ws.rs.core.Application
body: <p>Servlet 3.0-enabled containers allows us to skip the web.xml servlet configuration and automatically scan your code for resources and providers once you extend <code>javax.ws.rs.core.Application</code>, annotate it with <code>@ApplicationPath</code> and do not override the <code>getClasses()</code> method. (hope I got all of that right :\)</p>
  
  <p>At the moment I am using the Jersey implementation and securing resource methods using <code>@RolesAllowed</code> annotations. For this I need to register the <code>org.glassfish.jersey.server.filter.RolesAllowedDynamicFeature</code> Provider class, however, the only ways I'm aware of to do this is either to:</p>
  
  <ol>
  <li>Register the class in the <code>getClasses()</code> method of my <code>Application</code> class (which, I think, will cause the Servlet 3.0 container NOT to auto-scan)</li>
  <li><p>Continue to use the <b>web.xml</b> Jersey servlet setup with </p>
  
  <pre><code>&lt;init-param&gt;
      &lt;param-name&gt;jersey.config.server.provider.classnames&lt;/param-name&gt;
      &lt;param-value&gt;org.glassfish.jersey.server.filter.RolesAllowedDynamicFeature&lt;/param-value&gt;
  &lt;/init-param&gt;
  </code></pre></li>
  </ol>
  
  <p>Now the context behind this question is that I might have to switch to using RESTeasy and if I use option 1 it adds a Jersey dependency in the code and the code is no longer generic.</p>
  
  <p>How do I write my code to use security annotations while maintaining generic JAX-RS code that could be deployed to another Servlet 3.0 JAX-RS implementation?</p>