The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

Specifying Method Permissions Using Annotations
The method permissions for the methods of a bean class can be specified on the class, the
business methods of the class, or both. Method permissions can be specified on a method of the
bean class to override the method permissions value specified on the entire bean class. The
following annotations are used to specify method permissions:
■ @RolesAllowed("list-of-roles")
The value of the @RolesAllowed annotation is a list of security role names to be mapped to
the security roles that are permitted to execute the specified method or methods. Specifying
this annotation on the bean class means that it applies to all applicable business methods of
the class.
■ @PermitAll
The @PermitAll annotation specifies that all security roles are permitted to execute the
specified method or methods. Specifying this annotation on the bean class means that it
applies to all applicable business methods of the class.
■ @DenyAll
The @DenyAll annotation specifies that no security roles are permitted to execute the
specified method or methods.
The following example code illustrates the use of these annotations:
@RolesAllowed("admin")
public class SomeClass {
public void aMethod () {...}
public void bMethod () {...}
...
}
@Stateless public class MyBean implements A extends SomeClass {
}
@RolesAllowed("HR")
public void aMethod () {...}
public void cMethod () {...}
...
Securing Enterprise Beans
In this example, assuming aMethod, bMethod, and cMethod are methods of business interface A,
the method permissions values of methods aMethod and bMethod are @RolesAllowed("HR")
and @RolesAllowed("admin") respectively. The method permissions for method cMethod have
not been specified.
To clarify, the annotations are not inherited by the subclass per se, they apply to methods of the
superclass which are inherited by the subclass. Also, annotations do not apply to CMP entity
beans.
Chapter 29 • Securing Java EE Applications 805