Use @RolesAllowed annotation in tomcat using basic authentication in jax rs

I have a rest service like the following

@Path("/noticias")
public class ServicioNoticias {

    @GET
    @Produces(MediaType.APPLICATION_JSON)
    @RolesAllowed({ "user" })
    public List<Noticia> getNoticias() {

        List<Noticia> noticias = new ArrayList<Noticia>();
        noticias.add(new Noticia("1", "noticia1"));
        noticias.add(new Noticia("2", "noticia2"));

        return noticias;

    }


}

In which I am applying basic authentication to restrict access to it, add the following roles and permissions in tomcat-users.xml

<user username="cecilio" password="cecilio" roles="administrador"/>
<user username="yhorell" password="hello" roles="user"/>

Within my web.xml map those roles and assign the restrictions

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
    id="WebApp_ID" version="3.0">
    <display-name>JaxRxJackson</display-name>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>recurso noticias</web-resource-name>
            <url-pattern>/api/noticias/*</url-pattern>
            <http-method>GET</http-method>
        </web-resource-collection>
        <auth-constraint>
            <role-name>administrador</role-name>
            <role-name>user</role-name>
        </auth-constraint>
    </security-constraint>

    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>jaxrs</realm-name>
    </login-config>

    <security-role>
        <role-name>administrador</role-name>
    </security-role>

    <security-role>
        <role-name>user</role-name>
    </security-role>
</web-app>

In effect when I access that resource (localhost: // context / api / news) the basic authentication is activated and it asks me for the access credentials, I enter them but it is authenticated.

My problem is that I want that when logging in with a user with an administrator role, I do not have permission to see the getNews resource since it should only be accessed by a "normal" user.

I'm using tomcat 8.0 and jersey