I've just read your excerpt from the spec again and it seems to me there is not even a mapping. It's just redundant declaration of the same roles. Did I understand this correctly? It simply forces me to redeclare exactly the same that I already wrote into my @RolesAllowed annotations and my web.xml again in yet another file without mapping it, without adding additional meta-data (e.g. a multi-lingual name) and thus no benefit at all?
[Message sent by forum member 'nlmarco']
http://forums.java.net/jive/thread.jspa?messageID=475508