IBM WebSphere V5.0 Security - CGISecurity

5.1 Securing EJBsEJBs, or Enterprise Java Beans, are J2EE components which implement thebusiness logic of an application. They typically have access to sensitive data,and it is very important to understand how security is applied to these resources.There are three types of EJBs:1. Session Beans, which represent clients inside the J2EE server. Clients callsession bean methods to access an application.2. Entity Beans, which represent persistent business objects in an application’srelational database. Typically, each entity bean has an underlying table in thedatabase, and each instance of the bean corresponds to a row in that table.3. Message-Driven Beans, which allow J2EE applications to process messagesasynchronously. Message-driven beans’ methods are invoked by theapplication server runtime as part of message queue processing.Important: Since queued messages generally do not have anyauthentication information associated with them, authentication informationis unavailable to message-driven beans’ methods. As a result, securingmessage-driven beans from unauthorized access is really a matter ofsecuring the message queue.Security can be applied to EJBs in the following ways:► Access control can be applied to individual session and entity bean methodsso that only callers who are members of particular security roles can callthose methods.► Session and entity bean methods which need to be aware of the role oridentity or the caller can programmatically call the J2EE API methodsisCallerInRole and getCallerPrincipal to determine a caller’s role andprincipal, respectively. When using isCallerInRole, security role referencesare used, which are later mapped to security roles.Note: If WebSphere security is not enabled, or if the EJB is not a protectedresource, isCallerInRole will return false and getCallerPrincipal will returnUNKNOWN.Note: See below for details on how security role references areadministered for EJBs. Programmatic security is covered in detail inChapter 8, “Programmatic security” on page 179.74 IBM WebSphere V5.0 Security Handbook