eventhorizon | Event Sourcing for Go | Microservice library

You are using an EJB (@LocalBean) annotation. And you applied @RolesAllowed annotation. This means, your EJB / REST service invocation is automatically protected by the JEE runtime.

Basically, what you are doing in your interceptor is already performed by Wildfly. But in a different way. Now you accidentally have two ways or levels of authentication. I suggest you stick to a single implementation.

Either you go with JAAS framework or use your custom interceptor. You should not use both at the same time.

1. My recommended approach would be to setup a JAAS Login module in Wildfly. There should be plenty of examples of how to do that, e.g. use https://docs.wildfly.org/18/WildFly_Elytron_Security.html#Database_Authentication_Migration or JBoss Wildfly - database login module
2. Do not use JAAS and provide your custom security interceptor. Basically you could keep your interceptor class. In order to make it work, you could use your own set of annotations to check for access.