Novell Access Manager 3.1 SP 2, Руководство пользователя, Страница: 11 / 126

Installing the J2EE Agents
1
11
n
ov
do
cx (e
n)
16
Ap
ril 20
10
1
Installing the J2EE Agents
The J2EE Agents allow you to use roles and other types of policies to restrict access to specific
application modules and Enterprise JavaBeans. These agents leverage the Java Authentication and
Authorization Service (JAAS) and Java Authorization Contract for Containers (JACC) standards for
Access Manager-controlled authentication and authorization to Java Web applications and
Enterprise JavaBeans.
NOTE: You cannot upgrade J2EE Agents from version 3.0 to 3.1. You must perform a fresh
installation of the 3.1 version of J2EE Agents.
Access Manager currently has J2EE agents for JBoss, WebLogic, and WebSphere servers. The
agents can be installed on Linux, Windows, Solaris and AIX platforms.
This section has the following information:
Š
Section 1.1, “Overview of the J2EE Agents,” on page 11
Š Section 1.2, “Overview of the Sample Payroll Application,” on page 12
Š
Section 1.3, “Prerequisites,” on page 12
Š Section 1.4, “Software Requirements,” on page 12
Š
Section 1.5, “Installing the J2EE Agents on JBoss,” on page 13
Š Section 1.6, “Installing the J2EE Agent on WebSphere,” on page 22
Š
Section 1.7, “Installing the J2EE Agent on WebLogic,” on page 31
Š Section 1.8, “Verifying If a J2EE Agent Is Installed,” on page 43
Š
Section 1.9, “Uninstalling a J2EE Agent,” on page 43
1.1 Overview of the J2EE Agents
Users of application servers, such as J2EE servers, commonly fall into one of three abstract roles:
buyer, seller, or administrator. For example, a rental car company might apply a variety of Enterprise
JavaBeans (EJB) components that offer different products and services to clients. One service could
be a specific component that enables a Web-based reservation process. In this case, the customer
could access a Web site to reserve a rental car. The seller could access a site that provides a list of
available cars and prices. Then the administrator could access a site that tracked inventory and
maintenance schedules. These components provide the basic business services for the application to
function and the tasks they accomplish require a security policy to enforce appropriate use of such
services.
Using the deployment descriptors, the application developer can set up a method to protect the
components by using abstract security role names. For example, there can be a role called Service
Representative, which protects the component that creates a rental agreement. Similarly, there can
be a role called Approver, which protects the component that approves the agreement. Although
these roles convey the intent of the application vendor or developer to enforce such security policies,
they are not useful unless these abstract role names are mapped to real life principals such as actual
users or actual roles.