When I try to access protected pages I get this in my server log:
[Web-Security] hasResource isGranted: true
So, from this I conclude access is always granted, perhaps there is a misssing option I forgot in glassfish to enable or disable?
[Message sent by forum member 'guiomie']
http://forums.java.net/jive/thread.jspa?messageID=482139