Red Hat Application Server, Руководство пользователя

Страница: 153 / 296

Chapter 13.
Security Management
This chapter is for the Enterprise Bean provider; that is, the person in charge of developing the soft-
ware components on the server side.
13.1. Introduction
The EJB architecture encourages the Bean programmer to implement the Enterprise Bean class with-
out hard-coding the security policies and mechanisms into the business methods.
13.2. Declarative Security Management
The application assembler can define a security view of the Enterprise Beans contained in the EJB-
JAR file. The security view consists of a set of security roles . A security role is a semantic grouping
of permissions for a given type of application user that allows that user to successfully use the ap-
plication. The application assembler can define (declaratively in the deployment descriptor) method
permissions for each security role. A method permission is a permission to invoke a specified group
of methods for the Enterprise Beans’ home and remote interfaces. The security roles defined by the
application assembler present this simplified security view of the Enterprise Beans application to the
deployer; the deployer’s view of security requirements for the application is the small set of security
roles, rather than a large number of individual methods.
13.2.1. Security Roles
The application assembler can define one or more security roles in the deployment descriptor. The
application assembler then assigns groups of methods of the Enterprise Beans’ home and remote
interfaces to the security roles in order to define the security view of the application.
The scope of the security roles defined in the
security-role
elements is the EJB-JAR file level,
and this includes all the Enterprise Beans in the EJB-JAR file.
...
Ž
assembly-descriptor
 Ž
security-role
 Ž
role-name

tomcat
Ž
/role-name
 Ž
/security-role

...
Ž
/assembly-descriptor

13.2.2. Method Permissions
After defining security roles for the Enterprise Beans in the EJB-JAR file, the application assembler
can also specify the methods of the remote and home interfaces that each security role can invoke.
Method permissions are defined as a binary relationship in the deployment descriptor from the
set of security roles to the set of methods of the home and remote interfaces of the Enterprise
Beans, including all their super interfaces (including the methods of the
javax.ejb.EJBHome
and
javax.ejb.EJBObject
interfaces). The method permissions relationship includes the pair
(R, M)
only if the security role
R
is allowed to invoke the method
M
.