10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Securing Enterprise Beans<br />

804<br />

...<br />

<br />

AardvarkPayroll<br />

com.aardvark.payroll.PayrollBean<br />

...<br />

<br />

<br />

This role should be assigned to the<br />

employees of the payroll department.<br />

Members of this role have access to<br />

anyone’s payroll record.<br />

<strong>The</strong> role has been linked to the<br />

payroll-department role.<br />

<br />

payroll<br />

payroll-department<br />

<br />

...<br />

<br />

...<br />

<br />

...<br />

Specifying an Authentication Mechanism<br />

Authentications mechanisms are specified in the runtime deployment descriptor. When<br />

annotations, such as the @RolesAllowed annotation, are used to protect methods in the<br />

enterprise bean, you can configure the Interoperable Object Reference (IOR) to enable<br />

authentication for an enterprise application. This is accomplished by adding the<br />

element to the runtime deployment descriptor, sun-ejb-jar.xml.<br />

You can use the USERNAME-PASSWORD authentication method for an enterprise bean. You can<br />

use either the BASIC or CLIENT-CERT authentication methods for web service endpoints.<br />

For more information on specifying an authentication mechanism, read “Configuring IOR<br />

Security” on page 814 or “Example: Securing an Enterprise Bean” on page 818.<br />

Specifying Method Permissions<br />

If you have defined security roles for the enterprise beans in the ejb-jar file, you can also<br />

specify the methods of the business interface, home interface, component interface, and/or web<br />

service endpoints that each security role is allowed to invoke.<br />

You can use annotations and/or the deployment descriptor for this purpose. Refer to the<br />

following sections for more information on specifying method permissions:<br />

■ “Specifying Method Permissions Using Annotations” on page 805<br />

■ “Specifying Method Permissions Using Deployment Descriptors” on page 806<br />

<strong>The</strong> <strong>Java</strong> <strong>EE</strong> 5<strong>Tutorial</strong> • June 2010

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!