Can I use JAX-RS @RoleAllowed in the Rest API resource's method, if EJB is used

Question

According to the JBoss 7.1 Enterprise Edition, @RolesAllowed is not advised in the Resource's method, if RESTful services use EJB.

Do not activate role-based security if the application uses EJBs. The EJB container will provide the functionality, instead of RESTEasy.

Ref: https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.1/html/developing_web_services_applications/developing_jax_rs_web_services#Enable_Role-Based_Security_RESTEasy_JAX-RS_Web_Service

I am confused about the above statement. My application is build by JAX-RS layer and EJB layer. I am resolving role in the implementation of SecurityContext isUserInRole(String role) mehod. My web.xml is empty. Does it mean I am not allowed to use @RolesAllowed on my Resource's method because my REST services use EJB under the hood?

Answer 1

No and @RoleAllowed does not invoke SecurityContext isUserInRole(String role) method.

Therefore, create @Namebinding annotation based filter to handle the permission by SecurityContext isUserInRole(String role) is the best way to go.