JSR-000058 Java TM 2 Platform, Enterprise Edition 1.3 Specification

Step 4: Fulfilling the Original Request
If the user is authorized, the web server returns the result of the original URL
request, as shown in FIGURE 3-4.
Web Client
FIGURE 3-4 Fulfilling the Original Request
In this case, the response of a JSP page is returned. Next, the user performs some
action (perhaps posting form data) that needs to be handled by the business
logic component of the application.
Step 5. Invoking Enterprise Bean Business Methods
When the JSP page performs the remote method call to the enterprise bean, the
user’s credential is used to establish (as shown in FIGURE 3-5) a secure association
between the JSP page and the enterprise bean. The association is implemented
as two related security contexts, one in the web server and one in the EJB
container.
Web Client
Result of request
Post to business logic
credential
Session
Context
credential
Session
Context
Web Server
JSP/Servlet
Object
Web Server
JSP/Servlet
Object
Credential used to
establish security association
Security
Context
remote call
FIGURE 3-5 Invoking an Enterprise Bean Business Method
EJB Container
The EJB container is responsible for enforcing access control on the enterprise
bean method; it does so by consulting the security policy (derived from the
deployment descriptor) associated with the enterprise bean to determine the
security roles that are permitted access to the method. Then for each role, the
EJB container will use the security context associated with the call to determine
if it can map the caller to the role. The evaluation stops with an “is authorized”
outcome on the first role that the EJB container is able to map the caller to. A
3-4 Java 2 Platform Enterprise Edition, v1.3 Proposed Final Draft (Sun Microsystems, Inc.)
Authorization
EJB
Security
Context