IBM WebSphere V5.0 Security - CGISecurity

3.5 J2EE application security configurationThere are two aspects of application security administration which apply to allsecured J2EE application components: defining security roles (performed atapplication assembly time), and security role mapping (performed at deploymenttime). Additional application security administration tasks which apply to specificJ2EE components will be discussed in later chapters.Defining security roles can be performed using either of two WebSphere tools:► Application Assembly Tool► WebSphere Studio Application DeveloperSecurity role mapping can be performed using either of the above tools, or canbe performed using the WebSphere Administrative Console as part of theapplication installation.The following sections describe in detail how security roles are defined andmapped using each of these tools.Defining security roles in the Application Assembly ToolThis section will show how to define J2EE roles on the application level.Normally, roles are defined in the individual modules and then collectedautomatically into the application descriptor.It is still useful to define security roles for the application, when the applicationdesign and assembly follows the top-down design line or multiple assemblers areputting together the application and there is a lead assembler who conducts theassembly process. Security roles can be defined for the application and then beused on the module level; in this case, the application will not end up usingdifferent role names for the same role. Actually, in the WebSphere ApplicationAssembly Tool you can copy and paste roles back and forth between theapplication and its modules without creating them one by one.28 IBM WebSphere V5.0 Security Handbook