10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Securing Enterprise Beans<br />

812<br />

You must explicitly specify the run-as role name mapping to a given principal in sun-web.xml<br />

or sun-ejb-jar.xml if the given roles associate to more than one user principal.<br />

More detail about the elements contained in deployment descriptors is available in the <strong>Oracle</strong><br />

GlassFish Server 2.1.2 Application Deployment Guide.<br />

In either case, you will have to map the run-as role name to a given principal defined on the<br />

Application Server if the given roles associate to more than one user principal. Mapping roles to<br />

principals is described in “Mapping Security Roles to Application Server Groups” on page 809.<br />

Trust between Containers<br />

When an enterprise bean is designed so that either the original caller identity or a designated<br />

identity is used to call a target bean, the target bean will receive the propagated identity only; it<br />

will not receive any authentication data.<br />

<strong>The</strong>re is no way for the target container to authenticate the propagated security identity.<br />

However, because the security identity is used in authorization checks (for example, method<br />

permissions or with the isCallerInRole() method), it is vitally important that the security<br />

identity be authentic. Because there is no authentication data available to authenticate the<br />

propagated identity, the target must trust that the calling container has propagated an<br />

authenticated security identity.<br />

By default, the Application Server is configured to trust identities that are propagated from<br />

different containers. <strong>The</strong>refore, there are no special steps that you need to take to set up a trust<br />

relationship.<br />

Using Enterprise Bean Security Annotations<br />

Annotations are used in code to relay information to the deployer about security and other<br />

aspects of the application. Specifying this information in annotations or in the deployment<br />

descriptor helps the deployer set up the appropriate security policy for the enterprise bean<br />

application.<br />

Any values explicitly specified in the deployment descriptor override any values specified in<br />

annotations. If a value for a method has not been specified in the deployment descriptor, and a<br />

value has been specified for that method by means of the use of annotations, the value specified<br />

in annotations will apply. <strong>The</strong> granularity of overriding is on the per-method basis.<br />

<strong>The</strong> <strong>Java</strong> <strong>EE</strong> 5<strong>Tutorial</strong> • June 2010

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!