Description of problem: --- This is a Bugzillato have WFLY-3988 in EAP: https://issues.jboss.org/browse/WFLY-3988 --- Given this endpoint: @Stateless @WebService(endpointInterface="com.redhat.gss.SecureEndpoint") @DeclareRoles({"a","b"}) @WebContext(contextRoot="/endpoint",urlPattern="/e",authMethod="BASIC") public class SecureEndpointE implements SecureEndpoint { @RolesAllowed({"a"}) public String a() { return "Success"; } @RolesAllowed({"b"}) public String b() { return "Success"; } @PermitAll public String c() { return "Success"; } } One would expect any authenticated user to be able to invoke c(), but only users with a role found in @DeclareRoles can invoke it.
qa_acking for the stuff mentioned in Comment 1
Verified on EAP 6.4.3 CP CR1 - in conjunction with comment 1 Tested with endpoint defined like this: @Stateless @SecurityDomain("ejb3-test-security-domain") public class EJBEndpoint implements EJBEndpointIface { ... } No definition of@DeclareRoles or permissions like @RolesAllowed / @PermitAll on class level. Permissions are defined on method level.
Retroactively bulk-closing issues from released EAP 6.4 cummulative patches.