10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

For applications, you define security roles in the <strong>Java</strong> <strong>EE</strong> deployment descriptor file<br />

application.xml, and the corresponding role mappings in the Application Server deployment<br />

descriptor file sun-application.xml. For individually deployed web or EJB modules, you<br />

define roles in the <strong>Java</strong> <strong>EE</strong> deployment descriptor files web.xml or ejb-jar.xml and the<br />

corresponding role mappings in the Application Server deployment descriptor files<br />

sun-web.xml or sun-ejb-jar.xml.<br />

<strong>The</strong> following is an example of a security constraint from a web.xml application deployment<br />

descriptor file where the role of DEPT-ADMIN is authorized for methods that review employee<br />

data and the role of DIRECTOR is authorized for methods that change employee data.<br />

<br />

<br />

view dept data<br />

/hr/employee/*<br />

GET<br />

POST<br />

<br />

<br />

DEPT_ADMIN<br />

<br />

<br />

CONFIDENTIAL<br />

<br />

<br />

<br />

<br />

change dept data<br />

/hr/employee/*<br />

GET<br />

PUT<br />

<br />

<br />

DIRECTOR<br />

<br />

<br />

CONFIDENTIAL<br />

<br />

<br />

Working with Realms, Users, Groups, and Roles<br />

<strong>The</strong> web.xml application deployment descriptor is described in more detail in “Declaring<br />

Security Requirements in a Deployment Descriptor” on page 847.<br />

After users have provided their login information, and the application has declared what roles<br />

are authorized to access protected parts of an application, the next step is to map the security<br />

role to the name of a user, or principal. This step is discussed in the following section.<br />

Chapter 28 • Introduction to Security in the <strong>Java</strong> <strong>EE</strong> Platform 781

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!