IBM WebSphere V5.0 Security - CGISecurity

When an EJB uses the IsCallerInRole(Java.lang.String roleName) J2EE APImethod to determine whether or not the caller is a member of a particular role,roleName is a security role reference which is later linked to a defined securityrole in the EJB descriptor file, ejb-jar.xml. For example, the following Java codeshows how a security role referenced might be used.Example 5-2 Security role reference examplepublic String isInRole() {if (mySessionCtx.isCallerInRole("RoleRef")) {return "Caller is a member of the referenced role";} else {return "Caller is NOT a member of the referenced role";}}The following XML code shows how the security role reference RoleRef would belinked to the security role manager.Example 5-3 Security role reference in ejb-jar.xmlsecurity role reference RoleRef is linked to security rolemanagerRoleRefmanagerFor a security role reference to work, the security role to which it is linked mustbe a security role that is defined in the deployment descriptor and mapped to oneor more users, groups, or special subjects.Security role references in the Application Assembly ToolTo link the RoleRef security role reference to the manager security role using theApplication Assembly Tool, do the following:1. Open the EJB Modules folder for your application, and navigate to theSecurity Role References view, under a specific EJB module, for the EJBcontaining the method which calls isCallerInRole().2. If no security role references have previously been defined for EJBs, the boxon the right will be empty. Right-click the space under Name, and you will seea pop-up menu. Select New to create a new security role reference.3. In the New Security Role Reference dialog box (see Figure 5-6), enter thereference’s Name. This is the string that is passed to isCallerInRole() in theJava code.Chapter 5. Securing EJBs 81