Getting Started with WebSphere Application Server

Chapter 8 – Security 149
8.3 Implementing security in a Java EE application
In general, access to a secured Java EE resource requires the validation of credentials (user
ID/password) against the user registry. The user registry by itself does not enforce any security policies or
constraints (authorization); it simply validates the supplied user, group, and password information by the
Java EE authentication mechanisms.
Role-based security allows a developer to secure access to Java EE resources based on roles. Often a
developer has no knowledge of the users and groups that will exist at runtime; by using roles, he can
grant or revoke access to a specific artifact. Later, an administrator can map these roles to actual users
and groups.
Java EE has two forms of role-based security:
• Declarative security, where the security rules are defined in the deployment descriptors and the
Java EE runtime manages access to the Java EE artifact. A user will see all or none of a
resource.
• Programmatic security, where the program determines the role of a user and grants access to
different resources depending on this role. The user may only see a subset of a resource
depending on his role.
8.3.1 Defining role mapping
The mapping of specific users and groups to roles is defined in the Community Edition deployment plan,
which can either be Web, EJB, or EAR. For example, the code snippet shown in Listing 8.3 defines that
user bill will take the role as a super user, and the group employee will take the role of general
users.
Listing 8.3 - Role mappings
8.3.2 Implementing EJB Security
This section describes how to implement declarative and programmatic EJB security.
8.3.2.1 Declarative security