Declaring Roles Using Annotations
Declaring Roles Using Annotations
<%
} else {
%>
<fmt:message key=
"index.jsp.noprincipal"/>
<%
}
%>
<%
String role = request.getParameter(
"role");
if (role == null)
role =
"";
if (role.length() > 0) {
if (request.isUserInRole(role)) {
%>
<fmt:message key=
"index.jsp.granted"/> <b><%= role %></b><br><br>
<%
} else {
%>
<fmt:message key=
"index.jsp.notgranted"/> <b><%= role %></b><br><br>
<%
}
}
%>
<fmt:message key=
"index.jsp.tocheck"/>
<form method=
"GET">
<input type=
"text" name="role" value="<%= role %>">
</form>
</body>
</html>
Declaring and Linking Role References
A security role is an application-specific logical grouping of users, classified by common traits
such as customer profile or job title. When an application is deployed, these roles are mapped to
security identities, such as principals (identities assigned to users as a result of authentication)
or groups, in the runtime environment. Based on this mapping, a user with a certain security
role has associated access rights to a web application.
The value passed to the isUserInRole method is a String representing the role name of the
user. A security role reference defines a mapping between the name of a role that is called from a
web component using isUserInRole(String role) and the name of a security role that has
been defined for the application. If a <security-role-ref> element is not declared in a
deployment descriptor, and the isUserInRole method is called, the container defaults to
Checking Caller Identity Programmatically
The Java EE 5 Tutorial · September 2007
846
