Getting Started with WebSphere Application Server

Chapter 8 – Security 151
Listing 8.6 - The equivalent deployment descriptor
The benefit of using the deployment descriptors instead of the annotations is that the security definitions
can be changed at deployment time, without having to modify the source code. Deployment descriptors
always supersede annotations.
8.3.2.2 Programmatic security
Programmatic security is implemented in the EJB’s program logic. It references the role definitions in the
Geronimo deployment plan. Listing 8.7 shows an example where you define the roles before the EJB
implementation class definition.
@DeclareRoles( { "super_user", "general_user" })
public class HelloBean implements HelloWorld {
…
Listing 8.7 - Declare the roles before EJB class definition
Listing 8.8 provides an example of the class definition to insert the session context object that will be used
to determine if the current user has the declared role.
public class HelloBean implements HelloWorld {
@Resource
private SessionContext ctx;
…
Listing 8.8 - Inserting a session context
Listing 8.9 provides an example of the logic required to perform access control in your program.
System.out.println(ctx.getCallerPrincipal().getName());
if (ctx.isCallerInRole("super_user")){
//add any logic that is super user specific.
}
Listing 8.9 - Programmatic access control
8.3.2.3 Testing EJB security in a standalone client
To test EJB security in a standalone client, you first need to add the geronimo-security-2.1.4.jar
located under
\repository\org\apache\geronimo\framework\geronimosecurity\2.1.4\
into your client project’s build path. This JAR file contains classes that are returned to the client when
initializing to the server with a user ID identity. Without this JAR file, you will receive a
ClassNotFoundException at runtime.
For the initial context, use the properties as shown in Listing 8.10.
Hashtable props = new Hashtable();