J2EE(tm) BluePrints: Questions and Answers:

Questions and Answers - Security

How can I procedurally control information access in an Enterprise JavaBean^TM (EJB^TM) technology-enabled component?

Where should user registration be stored?

In an application that has two servlets - one of which is protected under the security model for the application while the other is not - will the security model kick in if the unsecure servlet forwards a request to the secure servlet ?

1. How can I procedurally control information access in an Enterprise JavaBean^TM (EJB^TM) technology-enabled component?

Usually, it's preferable to set up access control by declaratively defining method permissions in the enterprise bean's deployment descriptor. Such container-managed security makes an enterprise bean more flexible, since it isn't tied to the security roles defined by a particular application. Security holes due to programming errors is also less likely with container-managed security, since the security mechanism is implemented by the container.

Sometimes, though, procedural access control is necessary, for finer-grained or application-specific conditions. Enterprise beans can manage their own security by using method


EJBContext.isCallerInRole()

. Bean-managed security is useful in cases where finer, procedural access control is needed. Only enterprise bean methods for which the container has a client security context may use isCallerInRole(). (For more on bean-managed security, see http://java.sun.com/j2ee/j2sdkee/techdocs/guides/ejb/html/Security5.html.)

A security role is a named grouping of information resource access permissions, defined for an application. Associating a principal with a role confers the defined access permissions to that prinicpal as long as the principal is "in" the role. For example, an application may define a security role called guest, which provides read-only access to a small subset of all of the application's resources. Any principal in the guest role would then have read-only access to only those few resources.

An enterprise bean developer defines all security role names used in the enterprise bean code. Each security role name is defined in a deployment descriptor <security-role-ref> element, and is associated (via <role-link) with a security role defined elsewhere in the descriptor.

Security roles are defined with the application deployment descriptor element <role-name>. For example, the following enterprise bean deployment descriptor fragment defines a role name root, which is a reference (or <role-link>) to role super-user.

....
<enterprise-beans>
    ...
    <entity>
        <ejb-name>AnEntityBean</ejb-name>
        <ejb-class>AnEntityBean.class</ejb-class>
        ...
        <security-role-ref>
            <role-name>root</role-name>
            <role-link>super-user</role-link>
        </security-role-ref>
        ...
    </entity>
</enterprise-beans>
   .....

Class MyEntityBean uses the symbolic name "role" to check permissions.

Elsewhere in the deployment descriptor, the security role super-user is defined as:

....
<assembly-descriptor>
    <security-role>
        <description>This is the security-role for the security role
        "root" referenced in the AnEntityBean class</description>
        <role-name>super-user</role-name>
    </security-role>
</assembly-descriptor>
....

The descriptor defines a role name and associates it with a role link because different enterprise beans might differ in the name used to refer to the same application-specific cluster of permissions. For example, maybe some other bean needs to access the security-role super-user, but uses the string racine (instead of root) to identify the role. A <security-role-ref> could associate that bean's racine reference to the security role root.

A user or principal may belong to multiple roles simultaneously, and enjoys the union set of permissions those roles confer.

2. Where should user registration be stored?

In an enterprise setting, such information can be stored in the directory server, or persistently in database tables.

3. In an application that has two servlets - one of which is protected under the security model for the application while the other is not - will the security model kick in if the unsecure servlet forwards a request to the secure servlet ?

No, the security model will not intervene if the secured servlet is being requested by a forward() or include().

CONTENTS | PREV | NEXT | INDEX