Java EE 7 EJB Security not working

Question

I have a Java EE EAR Application running on wildfly 8.2,I am trying to implement Java EE declarative security to protect access to the EJB methods. Thus, I have added to the standalone.xml

<security-domain name="MyDomain" cache-type="default">
    <authentication>
        <login-module code="Database" flag="required">
            <module-option name="dsJndiName" value="java:jboss/datasources/MyDatasource"/>
            <module-option name="principalsQuery" value="select password from user where username = ?"/>
            <module-option name="rolesQuery" value="select DISTINCT r.name, 'Roles' from role r left join user_roles ur on ur.role_id=r.id left join user u on u.id=ur.user_id where u.username= ? and u.status=1 and r.active=1"/>
            <module-option name="hashAlgorithm" value="SHA-256"/>
            <module-option name="hashEncoding" value="base64"/>
            <module-option name="unauthenticatedIdentity" value="guest"/>
        </login-module>
    </authentication>
</security-domain>

In jboss-web.xml I have

<?xml version="1.0" encoding="UTF-8"?>
<jboss-web xmlns="http://www.jboss.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="       http://www.jboss.com/xml/ns/javaee       http://www.jboss.org/j2ee/schema/jboss-web_5_1.xsd">
  <security-domain>MyDomain</security-domain>
  <disable-audit>true</disable-audit>
  <context-root/>
</jboss-web>

and in web.xml I have

<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>MyDomain</realm-name>
    <form-login-config>
        <form-login-page>/login.xhtml</form-login-page>
        <form-error-page>/login.xhtml?failed=true</form-error-page>
    </form-login-config>
</login-config>

In one of the ManagedBeans I have

@Named("levelController")
@DeclareRoles({"Create-Level", "View-Level", "Edit-Level", "Delete-Level"})
public class LevelController implements Serializable {

   @DenyAll
   public String create() {
      //bla bla bla
   }

}

I accessed the levelController.create() from the jsf and was able to create Level successfully without logging in.

This simply implies that the security annotation is NOT working/maybe there is something I am not doing right. Can someone please help me spot out what the issue is

Answer 1

@DenyAll and @DeclareRoles (as well as @RolesAllowed) only work with EJB (session) beans, not with beans that are just named.

Try adding @Stateless to make your bean a session bean, or @Stateful in combination with a scope (eg @RequestScoped).