IBM WebSphere V5.0 Security - CGISecurity

These unprotected methods can have one of three permissions applied:1. Uncheck. This is the default, and indicates that unprotected methods shouldbe left unprotected. Anyone can call these methods.2. Exclude. Unprotected methods are unavailable to all callers.3. Role. Unprotected methods are available only to members of a specificsecurity role.Figure 5-5 Assigning roles to unprotected EJB methodsNote: This behavior is different than in previous WebSphere versions. InWebSphere Application Server Version 4, the default was to grant access toall EJB methods when no methods were explicitly protected, and to denyaccess to all EJB methods (by default) when at least one EJB method wasprotected.Most importantly, the default in Version 5 is for methods that are not explicitlyunprotected to be unchecked.5.4 Security role referencesSecurity role references are used to provide a layer of indirection betweensecurity roles named in EJB Java code and security roles that are defined atapplication assembly time. This allows security roles names to be modifiedwithout requiring changes in the application code.80 IBM WebSphere V5.0 Security Handbook