Red Hat Application Server, Руководство пользователя

Страница: 16 / 296

8 Chapter 1. Java Open Application Server (JOnAS): a J2EE Platform
•
EJB security is based on the concept of roles . The methods can be accessed by a given set of roles.
In order to access the methods, you must be in at least one role of this set.
The mapping between roles and methods (permissions) is done in the deployment descriptor using
the
security-role
and
method-permission
elements. Programmatic security management
is also possible using two methods of the EJBContext interface in order to enforce or comple-
ment security check in the bean code:
getCallerPrincipal()
and
isCallerInRole (String
roleName)
. The role names used in the EJB code (in the
isCallerInRole
method) are, in fact,
references to actual security roles, which makes the EJB code independent of the security configu-
ration described in the deployment descriptor. The programmer makes these role references avail-
able to the bean deployer or application assembler by way of the
security-role-ref
elements
included in the
session
or
entity
elements of the deployment descriptor.
•
Web security uses the same mechanisms; however, permissions are defined for URL patterns instead
of EJB methods. Therefore, the security configuration is described in the Web deployment descrip-
tor. Programmatically, the caller role is accessible within a web component via the
isUserInRole
(String roleName)
method.
In JOnAS, the mapping between roles and user identification is done in the user identification repos-
itory. When using Tomcat for user authentication, this user identification repository can be stored
either in files, in a JNDI repository (such as LDAP), or in a relational database. This is achieved
through a JOnAS implementation of the Realm for each Web container and through the JAAS (Java
Authentication and Authorization Service) login modules for Java clients.
Realms use authentication resources provided by JOnAS, which enable you to rely on files, LDAP,
or JDBC. These realms are in charge of propagating the security context to the EJB container dur-
ing EJB calls. JAAS login modules are provided for user authentication of Web Container and Java
clients. Certificate-based authentication is also available, with the CRLLoginModule login module for
certificate revocation.
JOnAS also implements the Java Authorization Contract for Containers (JACC 1.0) specification,
allowing you to manage authorizations as Java security permissions and to plug in any security policy
provider.
1.3.8. Messaging Service
Asynchronous EJB-method invocation is possible on Message-driven Bean components. A
Message-driven Bean is an EJB component that can be considered to be a JMS (Java Message
Service) MessageListener; that is, a service that processes JMS messages asynchronously (see
http://java.sun.com/products/jms). It is associated with a JMS destination. Its
onMessage
method is
activated on the reception of messages sent by a client application to this destination. It is also
possible for any EJB component to use the JMS API within the scope of transactions managed by the
application server.
For supporting Message-driven Beans and JMS operations coded within application components, the
JOnAS application server relies on a JMS implementation. JOnAS makes use of a third-party JMS im-
plementation; currently the JORAM open-source software is integrated and delivered with JOnAS, the
SwiftMQ product can also be used, and other JMS provider implementations can easily be integrated
(see http://joram.objectweb.org/ and http://www.swiftmq.com/). JORAM provides several noteworthy
features, particularly:
•
Reliability (with a persistent mode)
•
Distribution (transparently to the JMS client, it can run as several servers, thus allowing load bal-
ancing)
•
The choice of TCP or SOAP as the communication protocol for messages.