It does not appear to be possible to secure webservice endpoints at the moment, therefore EJB session beans exposed as webservices will not work if they use the @RolesAllowed annotation.
It would be nice to pass the values specified in the <web-service-security> tag in openejb-jar.xml were passed through to Tomcat/OpenEJB HTTP container, and to potentially support WS-Security schemes as well.
Description
It does not appear to be possible to secure webservice endpoints at the moment, therefore EJB session beans exposed as webservices will not work if they use the @RolesAllowed annotation.
It would be nice to pass the values specified in the <web-service-security> tag in openejb-jar.xml were passed through to Tomcat/OpenEJB HTTP container, and to potentially support WS-Security schemes as well.