WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

Users
Fred
Sally
Mike
Figure 12-4 User role mapping
Security Roles
Accountant
Manager
Clerk
This two-phase approach to security gives a great deal of flexibility because
deployers and administrators have control over how their users are mapped to
the various security roles.
Security for Java EE resources
Java EE containers enforce security in two ways:
► Declarative security
► Programmatic security
Declarative security
Declarative security is the means by which an application’s security policies can
be expressed externally to the application code. At application assembly time,
security policies are defined in an application deployment descriptor. A
deployment descriptor is an XML file that includes a representation of an
application’s security requirements, including the application’s security roles,
access control, and authentication requirements. When using declarative
security, application developers can write component methods that are
completely unaware of security. By making changes to the deployment
descriptor, an application’s security environment can be radically changed
398 WebSphere Application Server V7.0: Concepts, Planning, and Design
EJB Methods
Web Resources
JSPs
Servlets
HTML