Java EE 8 Cookbook

How it works...

Looking at UserServlet (which applies to the USER role), we first see the authentication step:

            securityContext.authenticate(                    request, response, withParams().credential(new                     CallerOnlyCredential(Roles.ADMIN)));

For example, we've used the role name as a username because if we look at the AuthenticationMechanism class (implementing HttpAuthenticationMechanism), we see it doing all the hard work of authenticating and assigning the right role to the user:

            Credential credential =             httpMessageContext.getAuthParameters()            .getCredential();            if (!(credential instanceof CallerOnlyCredential)) {                throw new IllegalStateException("Invalid mechanism");            }            CallerOnlyCredential callerOnlyCredential =             (CallerOnlyCredential)             credential; if ...