How to switch from web.xml based authorization to authorization via annotations in a JAX-RS application

Question

I have a working (web.xml based) container authentication and authorization. Due to the limitation of <url-pattern> I need to switch to javax.annotation.security annotations. I found out that I need a additional configuration in my web.xml in order to turn on the role based security annotations. Described in the RESTEasy UserGuide

But that doesn't work for me: I get an error 404 (Could not find resource for relative : /services/customers/1) depending on whether

<servlet>
    <servlet-name>Resteasy</servlet-name>
    <servlet-class>org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher</servlet-class>
</servlet>

<servlet-mapping>
    <servlet-name>Resteasy</servlet-name>
    <url-pattern>/*</url-pattern>
</servlet-mapping>

are defined in the web.xml or not right after the <context-param> and <listener>

This is my old (existing) web.xml:

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    version="2.5">

    <display-name>Store_Service</display-name>

    <session-config>
        <session-timeout>10</session-timeout>
    </session-config>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>SSL Secured WebService</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee> 
        </user-data-constraint>
    </security-constraint>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Authenticated customers only</web-resource-name>
            <url-pattern>/services/customers/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>CUST</role-name>
        </auth-constraint>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee> 
        </user-data-constraint>
    </security-constraint>

    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>Authentication-REALM</realm-name>
    </login-config>

    <security-role>
        <role-name>CUST</role-name>
    </security-role>

    <security-role>
        <role-name>ADMIN</role-name>
    </security-role>

    <welcome-file-list>
        <welcome-file>/index.xhtml</welcome-file>
    </welcome-file-list>

    <context-param>
        <param-name>javax.faces.PROJECT_STAGE</param-name>
        <param-value>Development</param-value>
    </context-param>

</web-app>

Which configuration items are still needed and which one need to be added in order to make @RolesAllowed("CUST") working.

Answer 1

I believe your web.xml needs the following:

<context-param>
   <param-name>resteasy.role.based.security</param-name>
   <param-value>true</param-value>
</context-param>

If everything fails, you could try to use the standard way, using SecurityContext:

@Context SecurityContext myContext;

@GET
@javax.ws.rs.Produces("text/html")
public Response doGet() {
  if(myContext.isUserInRole("CUST") == false) {
    return Response.status(Response.Status.UNAUTHORIZED).build();
  }
}