I currently have a web service running some basic authentication through Tomcat. I get the login box to pop up fine, and I can log in with accounts I have defined in the tomcat-users.xml file. However, when it comes to defining permissions based on roles, I'm having some issues.

Currently, I have three roles: manager, admin, and user. I have a few methods which should be only accessible by, say, an admin role. I can log in as my manager/admin/user super account and see everything just fine- but I can do the same as a normal user as well.

The methods are defined like so:

```
@Path("/Test")
@RolesAllowed("admin")
public class Test
{
    @GET
    @RolesAllowed("user")
    public methodThatMyUsersCanAcess{}

    @GET
    @Path("/Secure")
    @RolesAllowed("admin")
    public methodThatOnlyAdminsCanAcess{}
}

```

I'm really not sure how a 'user' role would be able to access the second method, but somehow it still happens.