@DeclareRoles("User1_role")
@Stateless
@Path("appx.me.org.DL")
public class DLFacadeREST extends AbstractFacade<DL> {
    @PersistenceContext(unitName = "app3PU")
	

 @GET
    @Override
    @Produces({"application/xml", "application/json"})
    @RolesAllowed("User1_role")
//    @PermitAll
    public List<DL> findAll() {
        return super.findAll();
    }
}

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.1" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd">
    <session-config>
        <session-timeout>
            30
        </session-timeout>
    </session-config>
    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>file</realm-name>
    </login-config>
</web-app>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd">
<glassfish-web-app error-url="">
  <class-loader delegate="true"/>
  <jsp-config>
    <property name="keepgenerated" value="true">
      <description>Keep a copy of the generated servlet class' java code.</description>
    </property>
  </jsp-config>
  <security-role-mapping>
    <role-name>User1_role</role-name>
    <principal-name>user1</principal-name>
    <group-name>User1_group</group-name>
  </security-role-mapping>
</glassfish-web-app>