I've just been reading JSR 250, which mentions this annotation:

javax.annotation.security.DeclareRoles

The DeclareRoles annotation appears similar to the javax.ejb.SecurityRoles annotation mentioned in other online documentation.

Neither annotation appears to be available - I am using the current JBoss 4.0.3 + EJB3. The JSR250 doc is dated 12/10, 5 days after the 4.0.3 became available, so I'm guessing this may not be implemented.

Some things are not clear in the JSR250 docs:

- is DeclareRoles mandatory, or do you only have to define it if you are using isUserInRole? In other words, if I have annotations like `RolesAllowed("role1")', then is it not necessary to also do DeclareRoles({"role1"})?

- can DeclareRoles be used in package-info.java as well as at the class level?