IBM WebSphere V5.0 Security - CGISecurity

4.4 Security role reference
During the development phase of the application, the actual role names for
security constraints may not be known to the groups of developers. On the other
hand, the actual role names in a deployed runtime environment may not be
known until the Web application and EJB modules are ready and assembled into
the .ear file. Therefore, the role names used during development are considered
to be “logical roles”. These logical roles are then mapped by the application
deployer into the actual runtime roles during the application assembly and
deployment phase.
Security role references provide a level of indirection to isolate roles used during
development and actual runtime roles. They link the names of the roles used in
the module to the corresponding name of the role in the encompassing
application.
The definition of the "logical" roles and the mapping to the actual runtime
environment roles are specified in the element of both the
Web application and the EJB jar file deployment descriptors, web.xml and
ejb-jar.xml respectively. The Application Assembly Tool (AAT) and WebSphere
Studio Application Developer can be used to both define the role-name and map
to the actual runtime roles in the environment with the role-link element.
Security role references with Application Assembly Tool
The example below provides instructions on how to define role references using
the Application Assembly Tool.
1. Start the Application Assembly Tool, open the itsobank.ear archive.
2. On the right-hand side, expand the tree: itsobank -> Web modules ->
itsobankWeb -> Web components -> TransferServlet -> Security Role
References.
3. Right-click the Security Reference node, then select New.
4. A window pops up with the settings. A Name specifies the name of a security
role reference used in the application code; type in RoleRef.
5. The link specifies the name of a security role defined in the encompassing
application, in our example, it is an application Web module; select manager
here.
6. You can write a description for the entry if you need to; actually this might be a
good place to put a description for future reference.
7. Click OK.
56 IBM WebSphere V5.0 Security Handbook