10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Discussion: Securing the Duke’s Bank Example<br />

<strong>The</strong> Duke’s Bank application is an online banking application. Duke’s Bank has two clients: an<br />

application client used by administrators to manage customers and accounts, and a web client<br />

used by customers to access account histories and perform transactions. <strong>The</strong> clients access the<br />

customer, account, and transaction information maintained in a database through enterprise<br />

beans. <strong>The</strong> Duke’s Bank application demonstrates the way that many of the component<br />

technologies presented in this tutorial (enterprise beans, application clients, and web<br />

components) are applied to provide a simple but functional application.<br />

To secure the Duke’s Bank example, the following security mechanisms are used:<br />

■ Defining security roles<br />

■ Specifying form-based user authentication for the web client in a security constraint<br />

■ Adding authorized users and groups to the appropriate Application Server realm<br />

■ Specifying method permissions for enterprise beans<br />

■ Configuring Interoperable Object References (IOR)<br />

Read Chapter 37, “<strong>The</strong> Duke’s Bank Application,” for more information on securing the Duke’s<br />

Bank example.<br />

Securing Application Clients<br />

Securing Application Clients<br />

<strong>The</strong> <strong>Java</strong> <strong>EE</strong> authentication requirements for application clients are the same as for other <strong>Java</strong><br />

<strong>EE</strong> components, and the same authentication techniques can be used as for other <strong>Java</strong> <strong>EE</strong><br />

application components.<br />

No authentication is necessary when accessing unprotected web resources. When accessing<br />

protected web resources, the usual varieties of authentication can be used, namely HTTP basic<br />

authentication, SSL client authentication, or HTTP login form authentication. <strong>The</strong>se<br />

authentication methods are discussed in “Specifying an Authentication Mechanism” on<br />

page 854.<br />

Authentication is required when accessing protected enterprise beans. <strong>The</strong> authentication<br />

mechanisms for enterprise beans are discussed in “Securing Enterprise Beans” on page 796.<br />

Lazy authentication can be used.<br />

An application client makes use of an authentication service provided by the application client<br />

container for authenticating its users. <strong>The</strong> container’s service can be integrated with the native<br />

platform’s authentication system, so that a single sign-on capability is employed. <strong>The</strong> container<br />

can authenticate the user when the application is started, or it can use lazy authentication,<br />

authenticating the user when a protected resource is accessed.<br />

Chapter 29 • Securing <strong>Java</strong> <strong>EE</strong> Applications 829

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!