Hello,

I'm using the following code as a testcase for EJB3-WS security.

package demo;

import javax.annotation.security.RolesAllowed;
import javax.annotation.security.DenyAll;
import javax.ejb.Stateless;
import javax.jws.WebService;

@WebService
@Stateless
//@RolesAllowed ("Person")
public class HelloBean3 {
public HelloBean3() {
}

@DenyAll
public String sayHello()

{ return "EJB3x: Hello my callee!"; }

}

unfortunately when it's deployed to the JBoss 4.2.3 AS, it does not deny any requests to sayHello operation, but runs them happily. I'm using web service client developed in Eclipse using Axis:

package demo;

public class Main {
public static void main(String[] args) throws Exception

{ // TODO Auto-generated method stub HelloBean3ServiceLocator loc = new HelloBean3ServiceLocator(); HelloBean3 hello = loc.getHelloBean3Port(); System.out.println("service tells me: `" + hello.sayHello() + "'"); }

}