One last piece of information that may be useful. This is the policy file that Glassfish has generated and that I'm guessing is being used.
grant {
permission javax.security.jacc.WebUserDataPermission "/secure/*";
permission javax.security.jacc.WebUserDataPermission "/:/secure/*";
permission javax.security.jacc.WebResourcePermission "/:/secure/*";
permission javax.security.jacc.WebResourcePermission "/secure/*", "!GET";
};
grant principal com.sun.enterprise.deployment.PrincipalImpl "DefaultRole" {
permission javax.security.jacc.WebRoleRefPermission "testServlet", "DefaultRole";
permission javax.security.jacc.WebRoleRefPermission "", "DefaultRole";
permission javax.security.jacc.WebRoleRefPermission "default", "DefaultRole";
permission javax.security.jacc.WebRoleRefPermission "jsp", "DefaultRole";
permission javax.security.jacc.WebResourcePermission "/secure/*", "GET";
};
[Message sent by forum member 'athrawn17' (athrawn17)]
http://forums.java.net/jive/thread.jspa?messageID=258385