title: EJB: custom authentication and authorisation
body: <p>I’m trying to add my own authentication and authorisation to Java EE REST application. I’ve managed to get working version with JAX-RS’s <code>SecurityContext</code>, <code>ContainerRequestFilter</code> implementation (with JWT) and <code>@RolesAllowed</code> annotations on end-point methods. But I need EJBs, and they don’t use JAX-RS’s SecurityContext at all (I’m getting <code>EJBAccessException</code> regardless of user roles), so I need another solution.</p>
  
  <p>Is there anything like <code>SecurityContext</code> in EJBs possible to implement? Or should I use a library like Shiro? I want to manage users from the application itself, so container- or LDAP-provided user management is not an option. I'm using JPA to authenticate and authorise a user.</p>
  
  <p>So, the main question is:</p>
  
  <p><strong>How do I implement my own authentication and role-based authorisation mechanisms working in EJBs (using @RolesAllowed annotations), based on JAX-RS filters?</strong> How do I tell EJB that a request is related to that concrete authenticated user with these roles?</p>
  
  <p>One more thing – I’d rather avoid vendor-specific solutions, but if I had to, I’d go with JBoss/Wildfly.</p>