10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Securing Enterprise Beans<br />

814<br />

■ <strong>The</strong> method-permission element is used to specify method permissions. Use of these<br />

elements is discussed in “Specifying Method Permissions Using Deployment Descriptors”<br />

on page 806.<br />

■ <strong>The</strong> run-as element is used to configure a component’s propagated security identity. Use of<br />

this element is discussed in “Configuring a Component’s Propagated Security Identity” on<br />

page 811.<br />

<strong>The</strong> schema for ejb-jar deployment descriptors can be found in section 18.5, Deployment<br />

Descriptor XML Schema,intheEJB 3.0 Specification (JSR-220) at http://jcp.org/en/jsr/<br />

detail?id=220.<br />

Configuring IOR Security<br />

<strong>The</strong> EJB interoperability protocol is based on Internet Inter-ORB Protocol (IIOP/GIOP 1.2)<br />

and the Common Secure Interoperability version 2 (CSIv2) CORBA Secure Interoperability<br />

specification.<br />

Enterprise beans that are deployed in one vendor’s server product are often accessed from <strong>Java</strong><br />

<strong>EE</strong> client components that are deployed in another vendor’s product. CSIv2, a<br />

CORBA/IIOP-based standard interoperability protocol, addresses this situation by providing<br />

authentication, protection of integrity and confidentiality, and principal propagation for<br />

invocations on enterprise beans, where the invocations take place over an enterprise’s intranet.<br />

CSIv2 configuration settings are specified in the Interoperable Object Reference (IOR) of the<br />

target enterprise bean. IOR configurations are defined in Chapter 24 of the CORBA/IIOP<br />

specification, Secure Interoperability. This chapter can be downloaded from<br />

http://www.omg.org/cgi-bin/doc?formal/02-06-60.<br />

<strong>The</strong> EJB interoperability protocol is defined in Chapter 14, Support for Distribution and<br />

Interoperability, of the EJB specification, which can be downloaded from<br />

http://jcp.org/en/jsr/detail?id=220.<br />

Based on application requirements, IORs are configured in vendor-specific XML files, such as<br />

sun-ejb-jar.xml, instead of in standard application deployment descriptor files, such as<br />

ejb-jar.xml.<br />

For a <strong>Java</strong> <strong>EE</strong> application, IOR configurations are specified in Sun-specific xml files, for<br />

example, sun-ejb-jar_2_1-1.dtd. <strong>The</strong> ior-security-config element describes the security<br />

configuration information for the IOR. A description of some of the major subelements is<br />

provided below.<br />

■ transport-config<br />

This is the root element for security between the endpoints. It contains the following<br />

elements:<br />

■ integrity: This element specifies whether the target supports integrity-protected<br />

messages for transport. <strong>The</strong> values are NONE, SUPPORTED,orREQUIRED.<br />

<strong>The</strong> <strong>Java</strong> <strong>EE</strong> 5<strong>Tutorial</strong> • June 2010

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!