IBM WebSphere V5.0 Security - CGISecurity

8.1 Programmatic securityJ2EE security can be applied declaratively or programmatically. This chapter willfocus on the latter option. Programmatic security can be used by security awareapplications when declarative security alone is not sufficient to express thesecurity model of the application.As an example, the ITSOBank application supplied with this book is configuredsuch that only managers and employees (clerks and accountants) can transferfunds but anyone can check their balance. This is possible because the methodpermissions for the getCustomerBalance method on the Consultation EJB allowsthe necessary role (in this case, Consultant) access. The request simply passesthe account key as a parameter.8.2 J2EE APIWebSphere provides a security infrastructure for application security which istransparent to the application developer. That is, the developer does not need tocode for security, since it will all be handled at deployment and runtime.Having said that, when developing servlets and EJBs, there are a few securitycalls available if the developer wants greater control of what the end user isallowed to do than is provided by the infrastructure.8.2.1 EJB security methodsThe EJB 2.0 specification defines two methods that allow programmatic accessto the caller’s security context, javax.ejb.EJBContext.► java.security.Principal getCallerPrincipal()The getCallerPrincipal method allows the developer to get the name of thecurrent caller. To do this, you need to call getName() on thejava.security.Principal object returned.EJBContext ejbContext;...// get the caller principaljava.security.Principal callerPrincipal = ejbContext.getCallerPrincipal();// get the caller’s nameString callerName = callerPrincipal.getName();The Principal.getName() method returns the login name of the user.180 IBM WebSphere V5.0 Security Handbook