IBM WebSphere V5.0 Security - CGISecurity

4.4 Security role referenceDuring the development phase of the application, the actual role names forsecurity constraints may not be known to the groups of developers. On the otherhand, the actual role names in a deployed runtime environment may not beknown until the Web application and EJB modules are ready and assembled intothe .ear file. Therefore, the role names used during development are consideredto be “logical roles”. These logical roles are then mapped by the applicationdeployer into the actual runtime roles during the application assembly anddeployment phase.Security role references provide a level of indirection to isolate roles used duringdevelopment and actual runtime roles. They link the names of the roles used inthe module to the corresponding name of the role in the encompassingapplication.The definition of the "logical" roles and the mapping to the actual runtimeenvironment roles are specified in the element of both theWeb application and the EJB jar file deployment descriptors, web.xml andejb-jar.xml respectively. The Application Assembly Tool (AAT) and WebSphereStudio Application Developer can be used to both define the role-name and mapto the actual runtime roles in the environment with the role-link element.Security role references with Application Assembly ToolThe example below provides instructions on how to define role references usingthe Application Assembly Tool.1. Start the Application Assembly Tool, open the itsobank.ear archive.2. On the right-hand side, expand the tree: itsobank -> Web modules ->itsobankWeb -> Web components -> TransferServlet -> Security RoleReferences.3. Right-click the Security Reference node, then select New.4. A window pops up with the settings. A Name specifies the name of a securityrole reference used in the application code; type in RoleRef.5. The link specifies the name of a security role defined in the encompassingapplication, in our example, it is an application Web module; select managerhere.6. You can write a description for the entry if you need to; actually this might be agood place to put a description for future reference.7. Click OK.56 IBM WebSphere V5.0 Security Handbook