Red Hat Application Server, Manual

Page: 155 / 296

Chapter 13. Security Management 147
then obtain the distinguished name of the caller principal using the
getName()
method of the
java.security.Principal
interface.
13.3.2. Use of isCallerInRole(String roleName)
The main purpose of the
isCallerInRole(String roleName)
method is to allow the Bean pro-
grammer to code the security checks that cannot be easily defined declaratively in the deployment
descriptor using method permissions. Such a check might impose a role-based limit on a request, or
it might depend on information stored in the database.
The Enterprise Bean code uses the
isCallerInRole(String roleName)
method to test whether
the current caller has been assigned to a given security role or not. Security roles are defined by the
application assembler in the deployment descriptor and are assigned to principals by the deployer.
13.3.3. Declaration of Security Roles Referenced from the Bean’s Code
The Bean programmer must declare in the
security-role-ref
elements of the deployment de-
scriptor all the security role names used in the Enterprise Bean code. Declaring the security roles’
references in the code allows the application assembler or deployer to link the names of the security
roles used in the code to the actual security roles defined for an assembled application through the
security-role
elements.
...
’
enterprise-beans
“
...
’
session
“
’
ejb-name
“
Op
’
/ejb-name
“ ’
ejb-class
“
sb.OpBean
’
/ejb-class
“
...
’
security-role-ref
“
’
role-name
“
role1
’
/role-name
“ ’
/security-role-ref
“
...
’
/session
“
...
’
/enterprise-beans
“
...
The deployment descriptor in this example indicates that the Enterprise Bean
Op
makes the security
checks using
isCallerInRole("role1")
in at least one of its business methods.
13.3.4. Linking Security Role References and Security Roles
If the
security-role
elements have been defined in the deployment descriptor, all the security role
references declared in the
security-role-ref
elements must be linked to the security roles defined
in the
security-role
elements.
The following deployment descriptor example shows how to link the security role references named
role1
to the security role named
tomcat
.
...
’
enterprise-beans
“
...
’
session
“ ’
ejb-name
“
Op
’
/ejb-name
“
’
ejb-class
“
sb.OpBean
’
/ejb-class
“