The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

Defining Security Requirements forWeb Applications
846
@DeclareRoles("BusinessAdmin")
public class CalculatorServlet {
//...
}
Specifying @DeclareRoles("BusinessAdmin") is equivalent to defining the following in
web.xml:
BusinessAdmin
The syntax for declaring more than one role is as shown in the following example:
@DeclareRoles({"Administrator", "Manager", "Employee"})
This annotation is not used to link application roles to other roles. When such linking is
necessary, it is accomplished by defining an appropriate security-role-ref in the associated
deployment descriptor, as described in “Declaring and Linking Role References” on page 842.
When a call is made to isUserInRole from the annotated class, the caller identity associated
with the invocation of the class is tested for membership in the role with the same name as the
argument to isUserInRole.Ifasecurity-role-ref has been defined for the argument
role-name, the caller is tested for membership in the role mapped to the role-name.
For further details on the @DeclareRoles annotation, refer to JSR–250, Common Annotations
for the Java Platform (http://www.jcp.org/en/jsr/detail?id=250), and “Using Enterprise
Bean Security Annotations” on page 812 in this tutorial.
Using the @RunAs Annotation
The @RunAs annotation defines the role of the application during execution in a Java EE
container. It can be specified on a class, allowing developers to execute an application under a
particular role. The role must map to the user/group information in the container’s security
realm. The value element in the annotation is the name of a security role of the application
during execution in a Java EE container. The use of the @RunAs annotation is discussed in more
detail in “Propagating Security Identity” on page 810.
The following is an example that uses the @RunAs annotation:
@RunAs("Admin")
public class CalculatorServlet {
@EJB private ShoppingCart myCart;
public void doGet(HttpServletRequest, req, HttpServletResponse res) {
//....
The Java EE 5Tutorial • June 2010