IBM WebSphere V5.0 Security - CGISecurity

3.3 J2EE Container-based security
J2EE Containers are responsible for enforcing access control on component
objects and methods. Containers provide two types of security:
► Declarative security
► Programmatic security
3.3.1 Declarative security
Declarative security is the means by which an application’s security policies can
be expressed externally to the application code. At application assembly time,
security policies are defined in an application’s deployment descriptor. A
deployment descriptor is an XML file which includes a representation of an
application’s security requirements, including the application’s security roles,
access control, and authentication requirements.
When using declarative security, application developers are free to write
component methods that are completely unaware of security. By making
changes to the deployment descriptor, an application’s security environment can
be radically changed without requiring any changes in application code.
3.3.2 Programmatic security
Programmatic security is used when an application must be “security aware”. For
instance, a method might need to know the identity of the caller for logging
purposes, or it might perform additional actions based on the caller’s role. The
J2EE Specification provides an API which includes methods for determining both
the caller’s identity and the caller’s role.
The EJB methods are:
► isCallerInRole
► getCallerPrincipal
The HttpServlet methods are:
► isUserInRole
► getUserPrincipal
The use of these methods will be discussed in Chapter 8, “Programmatic
security” on page 179.
Chapter 3. J2EE application security 25