IBM WebSphere V5.0 Security - CGISecurity

Figure 5-7 Add Security Role Reference dialog box in WebSphere Studio6. Select the desired security role from the Link pull-down menu. Only securityroles which have previously been defined in the EJB module are shown in thismenu.7. Optionally, enter a Description for this security role reference.8. Click OK to apply the changes and close the window.5.5 Delegation policyWhen an EJB calls a method in another EJB, the identity of the caller of the firstEJB is, by default, propagated to the next. In this way, all EJB methods in thecalling chain would see the same principal if they were to callgetCallerPrincipal(). Occasionally, however, it is desirable for one EJB to callanother with a previously defined identity, for instance one that is a member of aspecific role.One example is the case of a message-driven bean’s onMessage() methodwhich calls a protected method in an entity bean. Since message-driven beans’onMessage()methods are executed with no caller identity, this method cannotcall the protected entity bean method. By delegating the onMessage() method torun as a specific role, and adding this role to the protected entity bean method’saccess permissions, the onMessage() method can successfully access theprotected method.Chapter 5. Securing EJBs 83