The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

hr-department
This role includes the employees of the payroll
department. The role is allowed to view and
update the payroll entry for any employee.
payroll-department
This role should be assigned to the personnel
authorized to perform administrative functions
for the employee self-service application.
This role does not have direct access to
sensitive employee and payroll information.
admin
...
Linking Security Role References to Security Roles
The security role references used in the components of the application are linked to the security
roles defined for the application. In the absence of any explicit linking, a security role reference
will be linked to a security role having the same name.
You can explicitly link all the security role references declared in the @DeclareRoles annotation
or security-role-ref elements for a component to the security roles defined by the use of
annotations (as discussed in “Defining Security Roles” on page 802) and/or in the
security-role elements.
You use the role-link element to link each security role reference to a security role. The value
of the role-link element must be the name of one of the security roles defined in a
security-role element, or by the @DeclareRoles or @RolesAllowed annotations (as discussed
in “Defining Security Roles” on page 802). You do not need to use the role-link element to
link security role references to security roles when the role-name used in the code is the same as
the name of the security-role to which you would be linking.
The following example illustrates how to link the security role reference name payroll to the
security role named payroll-department:
...
Securing Enterprise Beans
Chapter 29 • Securing Java EE Applications 803