The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

Defining Security Requirements forWeb Applications
Declaring Roles Using Deployment Descriptor Elements
An example of declaring roles referenced in an application using deployment descriptor
elements is shown in the following web.xml deployment descriptor snippet:
...
cust
bankCustomer
...
When you use the isUserInRole(String role) method, the String role is mapped to the role
name defined in the element nested within the element.
The element in the web.xml deployment descriptor must match a
defined in the element of the web.xml deployment descriptor, as shown here:
bankCustomer
Defining Security Requirements forWeb Applications
844
Web applications are created by application developers who give, sell, or otherwise transfer the
application to an application deployer for installation into a runtime environment. Application
developers communicate how the security is to be set up for the deployed application
declaratively by use of the deployment descriptor mechanism or programmatically by use of
annotations. When this information is passed on to the deployer, the deployer uses this
information to define method permissions for security roles, set up user authentication, and
whether or not to use HTTPS for transport. If you don’t define security requirements, the
deployer will have to determine the security requirements independently.
If you specify a value in an annotation, and then explicitly specify the same value in the
deployment descriptor, the value in the deployment descriptor overrides any values specified in
annotations. If a value for a servlet has not been specified in the deployment descriptor, and a
value has been specified for that servlet by means of the use of annotations, the value specified in
annotations will apply. The granularity of overriding is on the per-servlet basis.
The web application deployment descriptor may contain an attribute of metadata-complete
on the web-app element. The metadata-complete attribute defines whether the web application
deployment descriptor is complete, or whether the class files of the JAR file should be examined
for annotations that specify deployment information. When the metadata-complete attribute
is not specified, or is set to false, the deployment descriptors examine the class files of
The Java EE 5Tutorial • June 2010