IBM WebSphere V5.0 Security - CGISecurity

5.1 Securing EJBs
EJBs, or Enterprise Java Beans, are J2EE components which implement the
business logic of an application. They typically have access to sensitive data,
and it is very important to understand how security is applied to these resources.
There are three types of EJBs:
1. Session Beans, which represent clients inside the J2EE server. Clients call
session bean methods to access an application.
2. Entity Beans, which represent persistent business objects in an application’s
relational database. Typically, each entity bean has an underlying table in the
database, and each instance of the bean corresponds to a row in that table.
3. Message-Driven Beans, which allow J2EE applications to process messages
asynchronously. Message-driven beans’ methods are invoked by the
application server runtime as part of message queue processing.
Important: Since queued messages generally do not have any
authentication information associated with them, authentication information
is unavailable to message-driven beans’ methods. As a result, securing
message-driven beans from unauthorized access is really a matter of
securing the message queue.
Security can be applied to EJBs in the following ways:
► Access control can be applied to individual session and entity bean methods
so that only callers who are members of particular security roles can call
those methods.
► Session and entity bean methods which need to be aware of the role or
identity or the caller can programmatically call the J2EE API methods
isCallerInRole and getCallerPrincipal to determine a caller’s role and
principal, respectively. When using isCallerInRole, security role references
are used, which are later mapped to security roles.
Note: If WebSphere security is not enabled, or if the EJB is not a protected
resource, isCallerInRole will return false and getCallerPrincipal will return
UNKNOWN.
Note: See below for details on how security role references are
administered for EJBs. Programmatic security is covered in detail in
Chapter 8, “Programmatic security” on page 179.
74 IBM WebSphere V5.0 Security Handbook