AuthenticRoast - Installation for Glassfish

• copy AuthenticRoast-Impl.jar and AuthenticRoast-API.jar to glassfish/lib/
• (re)start Glassfish
• Glassfish-Admin
• in Configuration → Security → Message Security click „New...“
• Authentication Layer: HttpServlet
• Default Provider: no
• Provider Type: server
• Provider ID: pluggable-auth
• Class Name: name.aikesommer.authenticator.AuthModule
• OK
• in Configuration → Security → Message Security → HttpServlet → Providers select „pluggable-auth“
• Request Policy
• Authenticate Source: sender
• Authenticate Recipient: before-content
• Response Policy:
• leave empty
• Save
• restart Glassfish

In your Web-App

• sun-web.xml
• <sun-web-app httpservlet-security-provider="pluggable-auth">
• create a class that implements PluggableAuthenticator
• register that class using Registry.register() during startup of your app
  (using a web-application-listener is the easiest way to do that)

That should be it!!
:-)