No further configuration is required - the JavaEE runtime will pick up the security constraint and configure the web container to match.

The developer will have to configure the web container to require authenticated access to the URLs corresponding to this resource, so the proper information can be propagated to the EJB container.

The developer will have to turn on authentication in the web container configuration file, so that all incoming requests are authenticated in order to be processed.

The developer will have to configure the web container to require authenticated access to the URLs corresponding to this resource, and then map web-tier roles to ejb-tier roles, since the JAX-RS and EJB runtimes cannot use the same set of roles.