10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Working with Security Roles<br />

840<br />

element must be the String used as the parameter to the<br />

HttpServletRequest.isUserInRole(String role) method. <strong>The</strong> role-link must contain the<br />

name of one of the security roles defined in the security-role elements. <strong>The</strong> container uses<br />

the mapping of security-role-ref to security-role when determining the return value of<br />

the call.<br />

Mapping Security Roles to Application Server Groups<br />

To map security roles to Application Server principals and groups, use the<br />

security-role-mapping element in the runtime deployment descriptor (DD). <strong>The</strong> runtime<br />

deployment descriptor is an XML file that contains information such as the context root of the<br />

web application and the mapping of the portable names of an application’s resources to the<br />

Application Server’s resources. <strong>The</strong> Application Server web application runtime DD is located<br />

in /WEB-INF/ along with the web application DD. Runtime deployment descriptors are named<br />

sun-web.xml, sun-application.xml,orsun-ejb-jar.xml.<br />

<strong>The</strong> following example demonstrates how to do this mapping:<br />

<br />

<br />

CEO<br />

smcneely<br />

<br />

<br />

Admin<br />

director<br />

<br />

...<br />

<br />

A role can be mapped to specific principals, specific groups, or both. <strong>The</strong> principal or group<br />

names must be valid principals or groups in the current default realm. <strong>The</strong> role-name element<br />

must match the role-name in the security-role element of the corresponding application<br />

deployment descriptor (web.xml, ejb-jar.xml) or the role name defined in the @DeclareRoles<br />

annotation.<br />

Sometimes the role names used in the application are the same as the group names defined on<br />

the Application Server. Under these circumstances, you can use the Admin Console to define a<br />

default principal to role mapping that apply to the entire Application Server instance. From the<br />

Admin Console, select Configuration, then Security, then check the enable box beside Default<br />

Principal to Role Mapping. For more information, read the <strong>Oracle</strong> GlassFish Server 2.1.2<br />

Developer’s Guide or <strong>Oracle</strong> GlassFish Server 2.1.2 Administration Guide.<br />

<strong>The</strong> <strong>Java</strong> <strong>EE</strong> 5<strong>Tutorial</strong> • June 2010

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!