Which annotation allows a request to be executed with another Principal's identity?

Question

Options

• AIt is not possible to execute a request with another Principal's identity.
• B@UseIdentity
• C@RolesAllowed
• D@Runs

• A
  6% (1)
• C
  88% (14)
• D
  6% (1)

Explanation

There appears to be an error in this question's answer key. Based on standard Java EE / Jakarta EE security specifications, @RolesAllowed (C) restricts which roles may invoke a method - it does not change the executing principal's identity.

The annotation that allows a component to execute under a different principal's identity is @RunAs - which most closely matches option D (@Runs), likely a typo or distractor variant of @RunAs.

Why each option is actually wrong or misleading:

• A - Incorrect; impersonation/identity delegation is possible in Java EE via @RunAs.
• B (@UseIdentity) - Not a standard Java EE annotation; fabricated distractor.
• C (@RolesAllowed) - Controls who can call a method (authorization), not as whom it runs.
• D (@Runs) - Not the exact annotation name, but the closest to the real answer: @RunAs.

Memory tip: Think "Run As someone else" → @RunAs. It's declared on a class (e.g., a servlet or EJB) and tells the container to propagate a specific security role as the caller identity during execution. @RolesAllowed = "only these roles may enter"; @RunAs = "while inside, pretend you are this role."

Recommendation: Double-check the source material for this question - the marked answer (C) conflicts with the Java EE specification. If this is from a specific framework (e.g., Quarkus, Spring), the correct annotation may differ.

No community discussion yet for this question.