Red Hat APPLICATION SERVER - JONAS Manual page 155

Chapter 13. Security Management
then obtain the distinguished name of the caller principal using the
java.security.Principal
13.3.2. Use of isCallerInRole(String roleName)
The main purpose of the
grammer to code the security checks that cannot be easily defined declaratively in the deployment
descriptor using method permissions. Such a check might impose a role-based limit on a request, or
it might depend on information stored in the database.
The Enterprise Bean code uses the
the current caller has been assigned to a given security role or not. Security roles are defined by the
application assembler in the deployment descriptor and are assigned to principals by the deployer.
13.3.3. Declaration of Security Roles Referenced from the Bean's Code
The Bean programmer must declare in the
scriptor all the security role names used in the Enterprise Bean code. Declaring the security roles'
references in the code allows the application assembler or deployer to link the names of the security
roles used in the code to the actual security roles defined for an assembled application through the
elements.
security-role
...
enterprise-beans
...
session
ejb-name Op /ejb-name
ejb-class sb.OpBean /ejb-class
...
security-role-ref
role-name role1 /role-name
/security-role-ref
...
/session
...
/enterprise-beans
...
The deployment descriptor in this example indicates that the Enterprise Bean
checks using
isCallerInRole("role1")
13.3.4. Linking Security Role References and Security Roles
If the
security-role
references declared in the
in the
security-role
The following deployment descriptor example shows how to link the security role references named
to the security role named
role1
...
enterprise-beans
...
session
ejb-name Op /ejb-name
ejb-class sb.OpBean /ejb-class
interface.
isCallerInRole(String roleName)
isCallerInRole(String roleName)
security-role-ref
elements have been defined in the deployment descriptor, all the security role
security-role-ref
elements.
.
tomcat
in at least one of its business methods.
elements must be linked to the security roles defined
method of the
getName()
method is to allow the Bean pro-
method to test whether
elements of the deployment de-
makes the security
Op
147