[JBoss] Can I use JAX-RS @RoleAllowed in the Rest API resource's method, if EJB is used

According to the JBoss 7.1 Enterprise Edition, @RolesAllowed is not advised in the Resource's method, if RESTful services use EJB.

Do not activate role-based security if the application uses EJBs. The EJB container will provide the functionality, instead of RESTEasy.

Ref: https://access.redhat.com/documenta...le-Based_Security_RESTEasy_JAX-RS_Web_Service
​

I am confused about the above statement. My application is build by JAX-RS layer and EJB layer. I am resolving role in the implementation of SecurityContext isUserInRole(String role) mehod. My web.xml is empty. Does it mean I am not allowed to use @RolesAllowed on my Resource's method because my REST services use EJB under the hood?

Continue reading...