Glassfish basic authentication in REST services

Question

I am trying to make basic authentication in Web Project using Glassfish jdbcRealm.

This is my web.xml authentication part:

<security-constraint>
    <display-name>LoginTestContraint</display-name>
    <web-resource-collection>
        <web-resource-name>Login</web-resource-name>
        <description/>
        <url-pattern>/login/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <description/>
        <role-name>UsersRead</role-name>
        <role-name>UsersWrite</role-name>
        <role-name>UsersDelete</role-name>
    </auth-constraint>
</security-constraint>
<security-constraint>
    <display-name>UsersConstraints</display-name>
    <web-resource-collection>
        <web-resource-name>FindAll</web-resource-name>
        <description/>
        <url-pattern>/resources/com.taxi.model.users/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <description/>
        <role-name>UsersRead</role-name>
        <role-name>UsersWrite</role-name>
        <role-name>UsersDelete</role-name>
    </auth-constraint>
</security-constraint>
<security-constraint>
    <display-name>AccessConstraints</display-name>
    <web-resource-collection>
        <web-resource-name>/resources/com.taxi.model.access</web-resource-name>
        <description/>
        <url-pattern>/resources/com.taxi.model.access/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <description/>
        <role-name>AccessRead</role-name>
        <role-name>AccessWrite</role-name>
        <role-name>AccessDelete</role-name>
    </auth-constraint>
</security-constraint>
<login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>taxiJDBCRealm</realm-name>
</login-config>
<security-role>
    <description/>
    <role-name>AccessRead</role-name>
</security-role>
<security-role>
    <description/>
    <role-name>AccessWrite</role-name>
</security-role>
<security-role>
    <description/>
    <role-name>AccessDelete</role-name>
</security-role>
<security-role>
    <description/>
    <role-name>UsersRead</role-name>
</security-role>
<security-role>
    <description/>
    <role-name>UsersWrite</role-name>
</security-role>
<security-role>
    <description/>
    <role-name>UsersDelete</role-name>
</security-role>

And this is what i have in glassfish-web.xml:

<glassfish-web-app error-url="">
  <security-role-mapping>
    <role-name>AccessDelete</role-name>
    <group-name>AccessDelete</group-name>
  </security-role-mapping>
  <security-role-mapping>
    <role-name>AccessRead</role-name>
    <group-name>AccessRead</group-name>
  </security-role-mapping>
  <security-role-mapping>
    <role-name>AccessWrite</role-name>
    <group-name>AccessWrite</group-name>
  </security-role-mapping>
  <security-role-mapping>
    <role-name>UsersDelete</role-name>
    <group-name>UsersDelete</group-name>
  </security-role-mapping>
  <security-role-mapping>
    <role-name>UsersRead</role-name>
    <group-name>UsersRead</group-name>
  </security-role-mapping>
  <security-role-mapping>
    <role-name>UsersWrite</role-name>
    <group-name>UsersWrite</group-name>
  </security-role-mapping>
  <class-loader delegate="true"/>
  <jsp-config>
    <property name="keepgenerated" value="true">
      <description>Keep a copy of the generated servlet class' java code.</description>
    </property>
  </jsp-config>
</glassfish-web-app>

I want to authenticate REST service users, so I do following:

@Stateless
@Path("com.taxi.model.users")
public class UsersFacadeREST extends AbstractFacade<Users> {

    // ...

    @GET
    @Override
    @Produces({"application/xml", "application/json"})
    @RolesAllowed("UsersRead")
    public List<Users> findAll() {
        return super.findAll();
    }

    // ...

}

@Stateless
@Path("com.taxi.model.access")
public class AccessFacadeREST extends AbstractFacade<Access> {

    // ...

    @GET
    @Override
    @Produces({"application/xml", "application/json"})
    @RolesAllowed("AccessRead")
    public List<Access> findAll() {
        return super.findAll();
    }

    // ...

}

When I try to open http://localhost:8080/taxi/resources/com.taxi.model.access it returns me XML with accesses.

So, then I try to open http://localhost:8080/taxi/resources/com.taxi.model.users in browser it is all works, but access is denied. In postgresql log file I see:

2011-08-15 13:32:14 SAMST LOG:  execute <unnamed>: SELECT glpasswd FROM vw_glusertable WHERE gluser = $1
2011-08-15 13:32:14 SAMST DETAIL:  parameters: $1 = 'nickla'
2011-08-15 13:32:14 SAMST LOG:  execute <unnamed>: SELECT glgroup FROM vw_glgrouptable WHERE gluser = $1 
2011-08-15 13:32:14 SAMST DETAIL:  parameters: $1 = 'nickla'

Glassfish error log:

FINE: [Web-Security] Setting Policy Context ID: old = null ctxID = taxi/taxi
FINE: [Web-Security] hasUserDataPermission perm: (javax.security.jacc.WebUserDataPermission /resources/com.taxi.model.users GET)
FINE: [Web-Security] hasUserDataPermission isGranted: true
FINE: [Web-Security] Policy Context ID was: taxi/taxi
FINE: [Web-Security] Codesource with Web URL: file:/taxi/taxi
FINE: [Web-Security] Checking Web Permission with Principals : null
FINE: [Web-Security] Web Permission = (javax.security.jacc.WebResourcePermission /resources/com.taxi.model.users GET)
FINEST: JACC Policy Provider: PolicyWrapper.implies, context (taxi/taxi)- result was(false) permission ((javax.security.jacc.WebResourcePermission /resources/com.taxi.model.users GET))
FINE: [Web-Security] hasResource isGranted: false
FINE: [Web-Security] hasResource perm: (javax.security.jacc.WebResourcePermission /resources/com.taxi.model.users GET)
FINEST: Processing login with credentials of type: class com.sun.enterprise.security.auth.login.common.PasswordCredential
FINE: Logging in user [nickla] into realm: taxiJDBCRealm using JAAS module: jdbcRealm
FINE: Login module initialized: class com.sun.enterprise.security.auth.login.JDBCLoginModule
FINEST: JDBC login succeeded for: nickla groups:[UsersRead, AccessRead, AccessWrite, UsersWrite, UsersDelete, AccessDelete]
FINE: JAAS login complete.
FINE: JAAS authentication committed.
FINE: Password login succeeded for : nickla
FINE: Set security context as user: nickla
FINE: [Web-Security] Policy Context ID was: taxi/taxi
FINE: [Web-Security] Codesource with Web URL: file:/taxi/taxi
FINE: [Web-Security] Checking Web Permission with Principals : nickla, UsersRead, AccessRead, AccessWrite, UsersWrite, UsersDelete, AccessDelete
FINE: [Web-Security] Web Permission = (javax.security.jacc.WebResourcePermission /resources/com.taxi.model.users GET)
FINEST: JACC Policy Provider: PolicyWrapper.implies, context (taxi/taxi)- result was(false) permission ((javax.security.jacc.WebResourcePermission /resources/com.taxi.model.users GET))
FINE: [Web-Security] hasResource isGranted: false
FINE: [Web-Security] hasResource perm: (javax.security.jacc.WebResourcePermission /resources/com.taxi.model.users GET)

Why is Glassfish told me that my user with role UsersRead has no grants for com.taxi.model.users?

P.S.:

Answer is simple - do not use UsersRead UsersWrite UsersDelete words as role names. I do not know why, but when I changed it to UsersRead11 all things go right.