Summary: Web Application projects must support a weblogic-ejb-jar.xml because it is required to do role mapping for EJBs.

Background/Setup:

WebLogic 12.1.1 and NetBeans 7.1.1.

Create a Web Application project (Java EE 6). This is NOT a EJB or EAR project. This is a WAR which contains EJBs.

You can log into the webtier using any of the following approaches:
* web.xml <security-constraint>
* @ServletSecurity
* HttpServletRequest.login(user,pass)

No matter which of the 3 login approaches are used, access to web tier resources is restricted by:
* web.xml <security-constraint>
* @ServletSecurity

To be able to login successfully the roles in an application must be mapped to either users or groups. For the web tier components this is done using weblogic.xml's <security-role-assignment> tag.

JUSTIFICATION STARTS HERE:
If a web tier component calls a EJB (local stateless bean) the web tier Principal is propagated over but the role mapping from weblogic.xml is NOT used.

This means that @RolesAllowed on a EJB method will ALWAYS throw a javax.ejb.EJBAccessException.

Also sessionContext.isCallerInRole("...") will return false for any role. 

To configure role mapping for local EJBs included in a Web Application you must also include a weblogic-ejb-jar.xml and duplicate the role mapping information that is present in weblogic.xml.

Some servers, like GlassFish, will read role mapping info for both Web and EJB tier components out of a single vendor specific DD but WebLogic requires both files to function properly.

PROBLEM 1: The New File wizard does not allow you to make a weblogic-ejb-jar.xml file. In the WebLogic category there is a single selection called WebLogic Descriptor which tries to pick the file you need based on the application type. This wizard should allow for all types of WebLogic deployment descriptors to be selected.

PROBLEM 2: Once the needed weblogic-ejb-jar.xml is placed in the WEB-INF folder it should also appear in the "Configuration Files" node of the Web Application project. It does not.

WORKAROUND: I'm creating a temporary EJB application, making a WebLogic deployment descriptor (weblogic-ejb-jar.xml) and copying the file over to the WEB-INF directory of my Web Application project and then populating the file with role mapping information. This is just to avoid having to type out all that XML schema info. I then delete the EJB project.