Defining a Security View

<< Deployment Descriptor Elements | Linking Security Role References >>

Defining a Security View

Defining a Security View of Enterprise Beans

You can define a security view of the enterprise beans contained in the ejb-jar file and pass this
information along to the deployer. When a security view is passed on to the deployer, the
deployer uses this information to define method permissions for security roles. If you don't
define a security view, the deployer will have to determine what each business method does to
determine which users are authorized to call each method.

A security view consists of a set of security roles, a semantic grouping of permissions that a given
type of users of an application must have to successfully access the application. Security roles
are meant to be logical roles, representing a type of user. You can define method permissions for
each security role. A method permission is a permission to invoke a specified group of methods
of the enterprise beans' business interface, home interface, component interface, and/or web
service endpoints. You can specify an authentication mechanism that will be used to verify the
identity of a user.

It is important to keep in mind that security roles are used to define the logical security view of
an application. They should not be confused with the user groups, users, principals, and other
concepts that exist in the Application Server.

The following sections discuss setting up security roles, authentication mechanisms, and
method permissions that define a security view:

"Defining Security Roles" on page 804

"Specifying an Authentication Mechanism" on page 806

"Specifying Method Permissions" on page 807

Defining Security Roles

Use the @DeclareRoles and @RolesAllowed annotations to define security roles using Java
language annotations. The set of security roles used by the application is the total of the security
roles defined by the security role names used in the @DeclareRoles and @RolesAllowed
annotations.

You can augment the set of security roles defined for the application by annotations using the
security-role

deployment descriptor element to define security roles, where you use the

role-name

element to define the name of the security role.

The following example illustrates how to define security roles in a deployment descriptor:

...

<assembly-descriptor>

<security-role>

This role includes the employees of the

enterprise who are allowed to access the

employee self-service application. This role

Securing Enterprise Beans

The Java EE 5 Tutorial · September 2007

804