IBM WebSphere V5.0 Security - CGISecurity

These unprotected methods can have one of three permissions applied:
1. Uncheck. This is the default, and indicates that unprotected methods should
be left unprotected. Anyone can call these methods.
2. Exclude. Unprotected methods are unavailable to all callers.
3. Role. Unprotected methods are available only to members of a specific
security role.
Figure 5-5 Assigning roles to unprotected EJB methods
Note: This behavior is different than in previous WebSphere versions. In
WebSphere Application Server Version 4, the default was to grant access to
all EJB methods when no methods were explicitly protected, and to deny
access to all EJB methods (by default) when at least one EJB method was
protected.
Most importantly, the default in Version 5 is for methods that are not explicitly
unprotected to be unchecked.
5.4 Security role references
Security role references are used to provide a layer of indirection between
security roles named in EJB Java code and security roles that are defined at
application assembly time. This allows security roles names to be modified
without requiring changes in the application code.
80 IBM WebSphere V5.0 Security Handbook