title: JavaEE: multi-module Maven project with Glassfish/Payara: ejb-jar.xml security roles not seen by EJB module
body: <p>I am migrating a large JavaEE web app to a multi-module Maven form.</p>
  
  <p>The roles declared for a specific EJB in the <code>ejb-jar.xml</code> are not being seen by that EJB when I run the multi-module web app.</p>
  
  <p>The <code>ejb-jar.xml</code> is identical to the one I had in the single large web app (which worked fine), except for a change in the qualified name (packaging) of the EJB, which has been carefully matched in the new <code>ejb-jar.xml</code>.</p>
  
  <p>The <code>@Resource SessionContext ctx</code> is working: it can see the <code>Principal</code> etc.</p>
  
  <p>It just does not detect any of the roles from the <code>ejb-jar.xml</code> any more, so <code>ctx.isCallerInRole(String)</code> always fails.</p>
  
  <p>I can use <code>@DeclareRoles</code> annotations in the EJB and it works (but that's not an acceptable solution, it's just for diagnosis).</p>
  
  <p>The <code>ejb-jar.xml</code> in the EJB module is at:</p>
  
  <pre><code>.../src/main/resources/META-INF/ejb-jar.xml
  </code></pre>
  
  <p>Maven builds it to:</p>
  
  <pre><code>.../target/classes/META-INF/ejb-jar.xml
  </code></pre>
  
  <p>And it definitely makes it into the final target jar for the EJB module (I have even extracted it and checked).</p>
  
  <p>The deployment is to the same Glassfish or Payara server as for the single large web app (where it worked fine).</p>
  
  <p>I am not getting any relevant logged warnings of any kind during deployment.</p>
  
  <p>Grateful for ideas about what else could be preventing the system from apparently catching the <code>ejb-jar.xml</code> on deployment of the multi-module web app project, or for suggestions on how to further diagnose the problem.</p>
  
  <hr>
  
  <hr/>
  
  <p>EDIT 2017-03-15: I found (after some sleep) that if I copy (or move) the <code>ejb-jar.xml</code> from the EJB module to <code>.../src/main/webapp/WEB-INF/</code> of the web module it works as expected. But this is not quite a solution, as I want different web modules to be able to use the same EJB module, and also it means that the <code>&lt;security-role&gt;</code> and any <code>&lt;security-role-ref&gt;</code> and <code>&lt;role-link&gt;</code> are in one web module not the EJB module. I am also using the EJB module for REST services (independent of web role context) and want the same role concepts (so defined in the EJB module).</p>