10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Mapping Security Roles to Application Server Groups<br />

<strong>The</strong> Application Server assigns users to principals or groups, rather than to security roles. When<br />

you are developing a <strong>Java</strong> <strong>EE</strong> application, you don’t need to know what categories of users have<br />

been defined for the realm in which the application will be run. In the <strong>Java</strong> <strong>EE</strong> platform, the<br />

security architecture provides a mechanism for mapping the roles defined in the application to<br />

the users or groups defined in the runtime realm.<br />

To map a role name permitted by the application or module to principals (users) and groups<br />

defined on the server, use the security-role-mapping element in the runtime deployment<br />

descriptor (sun-application.xml, sun-web.xml,orsun-ejb-jar.xml) file. <strong>The</strong> entry needs to<br />

declare a mapping between a security role used in the application and one or more groups or<br />

principals defined for the applicable realm of the Application Server. An example for the<br />

sun-application.xml file is shown below:<br />

<br />

<br />

CEO<br />

jschwartz<br />

<br />

<br />

ADMIN<br />

directors<br />

<br />

<br />

Securing Enterprise Beans<br />

<strong>The</strong> role name can be mapped to either a specific principal (user), a group, or both. <strong>The</strong><br />

principal or group names referenced must be valid principals or groups in the current default<br />

realm of the Application Server. <strong>The</strong> role-name in this example must exactly match the<br />

role-name in the security-role element of the corresponding web.xml file or the role name<br />

defined in the @DeclareRoles or @RolesAllowed annotations.<br />

Sometimes the role names used in the application are the same as the group names defined on<br />

the Application Server. Under these circumstances, you can enable a default principal-to-role<br />

mapping on the Application Server using the Admin Console. To enable the default<br />

principal-to-role-mapping, follow these steps:<br />

1. Start the Application Server, then the Admin Console.<br />

2. Expand the Configuration node.<br />

3. Select the Security node.<br />

4. On the Security page, check the Enabled box beside Default Principal to Role Mapping.<br />

For an enterprise application, you can specify the security role mapping at the application layer,<br />

in sun-application.xml, or at the module layer, in sun-ejb-jar.xml. When specified at the<br />

application layer, the role mapping applies to all contained modules and overrides same-named<br />

role mappings at the module layer. <strong>The</strong> assembler is responsible for reconciling the<br />

module-specific role mappings to yield one effective mapping for the application.<br />

Chapter 29 • Securing <strong>Java</strong> <strong>EE</strong> Applications 809

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!