2. Using the Tutorial Examples
3. Getting Started with Web Applications
5. JavaServer Pages Technology
7. JavaServer Pages Standard Tag Library
10. JavaServer Faces Technology
11. Using JavaServer Faces Technology in JSP Pages
12. Developing with JavaServer Faces Technology
13. Creating Custom UI Components
14. Configuring JavaServer Faces Applications
15. Internationalizing and Localizing Web Applications
16. Building Web Services with JAX-WS
17. Binding between XML Schema and Java Classes
19. SOAP with Attachments API for Java
21. Getting Started with Enterprise Beans
23. A Message-Driven Bean Example
24. Introduction to the Java Persistence API
25. Persistence in the Web Tier
26. Persistence in the EJB Tier
27. The Java Persistence Query Language
28. Introduction to Security in the Java EE Platform
Accessing an Enterprise Bean Caller's Security Context
Declaring Security Role Names Referenced from Enterprise Bean Code
Declaring Security Roles Using Annotations
Declaring Security Roles Using Deployment Descriptor Elements
Defining a Security View of Enterprise Beans
Specifying an Authentication Mechanism
Mapping Security Roles to Application Server Groups
Using Enterprise Bean Security Annotations
Using Enterprise Bean Security Deployment Descriptor Elements
Deploying Secure Enterprise Beans
Accepting Unauthenticated Users
Accessing Unprotected Enterprise Beans
Enterprise Bean Example Applications
Example: Securing an Enterprise Bean
Building, Deploying, and Running the Secure Cart Example Using NetBeans IDE
Building, Deploying, and Running the Secure Cart Example Using Ant
Example: Using theisCallerInRole andgetCallerPrincipal Methods
Modifying Runtime Properties for the Secure Converter Example
Building, Deploying, and Running the Secure Converter Example Using NetBeans IDE
Building, Deploying, and Running the Secure Converter Example Using Ant
Troubleshooting the Secure Converter Application
Discussion: Securing the Duke's Bank Example
Configuring Resource Adapter Security
Mapping an Application Principal to EIS Principals
31. The Java Message Service API
32. Java EE Examples Using the JMS API
36. The Coffee Break Application
Chapter 29
Securing Java EE Applications
Java EE applications are made up of components that can be deployed intodifferent containers. These components are used to build multitier enterprise applications. Security servicesare provided by the component container and can be implemented using declarative orprogrammatic techniques. Java EE security services provide a robust and easily configured securitymechanism for authenticating users and authorizing access to application functions and associated data. JavaEE security services are separate from the security mechanisms of the operating system.
The ways to implement Java EE security services are discussed in ageneral way inSecuring Containers. This chapter provides more detail and a few examples thatexplore these security services as they relate to Java EE components. Java EEsecurity services can be implemented in the following ways:
Metadata annotations (or simply,annotations) enable a declarative style of programming. Users can specify information about security within a class file using annotations. When the application is deployed, this information can either be used by or overridden by the application deployment descriptor.
Declarative security expresses an application’s security structure, including security roles, access control, and authentication requirements in a deployment descriptor, which is external to the application.
Any values explicitly specified in the deployment descriptor override any values specified in annotations.
Programmatic security is embedded in an application and is used to make security decisions. Programmatic security is useful when declarative security alone is not sufficient to express the security model of an application.
Some of the material in this chapter assumes that you have alreadyreadChapter 28, Introduction to Security in the Java EE Platform.
This chapter includes the following topics:
Chapter 30, Securing Web Applications discusses security specific to web components such as servlets and JSP pages.
Copyright © 2010, Oracle and/or its affiliates. All rights reserved.Legal Notices