Websocket authentication in Wildfly with RolesAllowed

Question

I have a web socket defined using standard annotation like so

@ServerEndpoint("/mySocket")
@Singleton
public class myWebsocket {

@Inject
private MyEjb myEjb;

@OnMessage
public void message(Session session, String msg) { ...

Even though my user has logged in, I get access exceptions when calling myEjb because it doesn't recognize my user. If I check the principal of my session object

session.getUserPrincipal().getName()

the correct user is found, however, if I check the jboss SecurityContext class, I see an anonymous user

Answer 1

This is a known deficiency in Java EE 7 WebSocket specification, see the following issue in their bug-tracker.

However, there is a workaround available, see the JBoss Security Extended project and this example .