The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

Checking Caller Identity Programmatically
842
} else {
}
String role = request.getParameter("role");
if (role == null)
role = "";
if (role.length() > 0) {
if (request.isUserInRole(role)) {
}
} else {
}
Declaring and Linking Role References
A security role is an application-specific logical grouping of users, classified by common traits
such as customer profile or job title. When an application is deployed, these roles are mapped to
security identities, such as principals (identities assigned to users as a result of authentication)
or groups, in the runtime environment. Based on this mapping, a user with a certain security
role has associated access rights to a web application.
The value passed to the isUserInRole method is a String representing the role name of the
user. A security role reference defines a mapping between the name of a role that is called from a
web component using isUserInRole(String role) and the name of a security role that has
been defined for the application. If a element is not declared in a
deployment descriptor, and the isUserInRole method is called, the container defaults to
The Java EE 5Tutorial • June 2010