10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Overview of <strong>Java</strong> <strong>EE</strong> Security<br />

766<br />

FIGURE 28–3 URL Authorization<br />

Web Client<br />

Request access<br />

to protected<br />

resource<br />

<strong>The</strong> web server’s evaluation stops with an “is authorized” outcome when the web server is able<br />

to map the user to a role. A “not authorized” outcome is reached if the web server is unable to<br />

map the user to any of the permitted roles.<br />

Step 4: Fulfilling the Original Request<br />

Web Server<br />

credential JSP/servlet<br />

Object<br />

If the user is authorized, the web server returns the result of the original URL request, as shown<br />

in Figure 28–4.<br />

FIGURE 28–4 Fulfilling the Original Request<br />

Web Client<br />

Result<br />

of request<br />

Post to<br />

business logic<br />

Session<br />

Context<br />

In our example, the response URL of a JSP page is returned, enabling the user to post form data<br />

that needs to be handled by the business logic component of the application. Read Chapter 30,<br />

“Securing Web Applications,” for more information on protecting web applications.<br />

Step 5: Invoking Enterprise Bean Business Methods<br />

<strong>The</strong> JSP page performs the remote method call to the enterprise bean, using the user’s credential<br />

to establish a secure association between the JSP page and the enterprise bean (as shown in<br />

Figure 28–5). <strong>The</strong> association is implemented as two related security contexts, one in the web<br />

server and one in the EJB container.<br />

<strong>The</strong> <strong>Java</strong> <strong>EE</strong> 5<strong>Tutorial</strong> • June 2010<br />

Authorization<br />

Web Server<br />

credential JSP/servlet<br />

Session<br />

Context

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!