The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

Accepting Unauthenticated Users
Web applications accept unauthenticated web clients and allow these clients to make calls to the
EJB container. The EJB specification requires a security credential for accessing EJB methods.
Typically, the credential will be that of a generic unauthenticated user. The way you specify this
credential is implementation-specific.
In the Application Server, you must specify the name and password that an unauthenticated
user will use to log in by modifying the Application Server using the Admin Console:
1. Start the Application Server, then the Admin Console.
2. Expand the Configuration node.
3. Select the Security node.
4. On the Security page, set the Default Principal and Default Principal Password values.
Accessing Unprotected Enterprise Beans
If the deployer has granted full access to a method, any user or group can invoke the method.
Conversely, the deployer can deny access to a method.
To modify which role can be used in applications to grant authorization to anyone, specify a
value for Anonymous Role. To set the Anonymous Role field, follow these steps:
1. Start the Application Server, then the Admin Console.
2. Expand the Configuration node.
3. Select the Security node.
4. On the Security page, specify the Anonymous Role value.
Enterprise Bean Example Applications
Enterprise Bean Example Applications
The following example applications demonstrate adding security to enterprise beans
applications:
■ “Example: Securing an Enterprise Bean” on page 818 demonstrates adding basic login
authentication to an enterprise bean application.
■ “Example: Using the isCallerInRole and getCallerPrincipal Methods” on page 823
demonstrates the use of the getCallerPrincipal() and isCallerInRole(String role)
methods.
■ “Discussion: Securing the Duke’s Bank Example” on page 829 provides a brief discussion of
how the Duke’s Bank example provides security in that application.
Chapter 29 • Securing Java EE Applications 817