IBM WebSphere V5.0 Security - CGISecurity

8.1 Programmatic security
J2EE security can be applied declaratively or programmatically. This chapter will
focus on the latter option. Programmatic security can be used by security aware
applications when declarative security alone is not sufficient to express the
security model of the application.
As an example, the ITSOBank application supplied with this book is configured
such that only managers and employees (clerks and accountants) can transfer
funds but anyone can check their balance. This is possible because the method
permissions for the getCustomerBalance method on the Consultation EJB allows
the necessary role (in this case, Consultant) access. The request simply passes
the account key as a parameter.
8.2 J2EE API
WebSphere provides a security infrastructure for application security which is
transparent to the application developer. That is, the developer does not need to
code for security, since it will all be handled at deployment and runtime.
Having said that, when developing servlets and EJBs, there are a few security
calls available if the developer wants greater control of what the end user is
allowed to do than is provided by the infrastructure.
8.2.1 EJB security methods
The EJB 2.0 specification defines two methods that allow programmatic access
to the caller’s security context, javax.ejb.EJBContext.
► java.security.Principal getCallerPrincipal()
The getCallerPrincipal method allows the developer to get the name of the
current caller. To do this, you need to call getName() on the
java.security.Principal object returned.
EJBContext ejbContext;
...
// get the caller principal
java.security.Principal callerPrincipal = ejbContext.getCallerPrincipal();
// get the caller’s name
String callerName = callerPrincipal.getName();
The Principal.getName() method returns the login name of the user.
180 IBM WebSphere V5.0 Security Handbook