creating competitive advantage Copyright © 2003 Enterprise Java Beans Presenter: Wickramanayake HMKSK Version:0.1 Last Updated: 02-Sept-2003 EJB-Tier Security

creating competitive advantage Copyright © 2003 creating competitive advantage Contents  Overview  EJB Security Terms  Relationship between EJB Security Entities  Declarative Security  Programmatic Security  Responsibilities of  Bean Developer  Application Assembler  Deployer

creating competitive advantage Copyright © 2003 creating competitive advantage Overview  In general, users of a system are required to be authorized to perform various operations  The process of authorization depends on proper identification of users  The process of identification depends on proper authentication  With EJBs, you can obtain security features in two forms:  Declarative Security - No hard coding, but specify requirements in the DD  Programmatic Security - A combination of coding as well as specification in the DD

creating competitive advantage Copyright © 2003 creating competitive advantage EJB Security Terms  User  The end user or client making the call. Could be a system name, an IP address or some other form of identification  Principal  A user identity that has been sufficiently authenticated based on the requirements of the target runtime environment  Role  A logical grouping encapsulating the representation of a set of needs.  Security Domain  Defined in the target environment generally as the namespace of the set of users, principals, roles/memberships and mappings to DD roles  Security View  The set of roles as defined by the application assembler and placed in the DD.

creating competitive advantage Copyright © 2003 creating competitive advantage Relationship Between EJB Security Entities Dan (IP Add) John (cert) Dan (IP Add) John (cert) Chief Accnt John Mathew Payroll Updater Empl Reporter Payroll Chief Management UsersPrincipalsRoles Role References DD

creating competitive advantage Copyright © 2003 creating competitive advantage Declarative Security Example  Declare method permissions (associate methods with roles): 1.Select the enterprise bean. 2.Select the Security tab. 3.In the Method Permissions table, select “Sel Roles” in the Availability column. 4.Then select a role's checkbox if that role should be allowed to invoke a method.  Map roles to J2EE users and groups: 1.Select the application 2.Select the Security tab 3.Associate roles with J2EE users/groups

creating competitive advantage Copyright © 2003 creating competitive advantage Programmatic Security  Using getCallerPrincipal() method  Allows bean to verify principal  Not intended for security enforcement  Does not utilize roles Principal p = ctx.getCallerPrincipal(); if(p.getName().equalsIgnoreCase(“Fred Smith”)) // tailor the method for Fred Smith else // unrecognized name throw new MyApplicationException(p.getName() + “ invalid”); public String getUser() { return context.getCallerPrincipal().getName(); }

creating competitive advantage Copyright © 2003 creating competitive advantage Programmatic Security  Using isCallerInRole() method  Somewhat similar to getCallerPrincipal()  Allows recognition of roles without bean trying to identify principal  Role can be defined in the DD as a reference  Would introduce portability problems! if(ctx.isCallerInRole(“payroll-admin”)) // then allow editing the payroll info else // not an administrator // allow viewing of data only

creating competitive advantage Copyright © 2003 creating competitive advantage Responsibilities of Bean Developer  Normally the bean provider does not stipulate any security requirements  If the been provider is making a reference to a role name in the bean, a bean reference must be declared. Employees... Needs access to update payroll info payroll-admin...

creating competitive advantage Copyright © 2003 creating competitive advantage Responsibilities of Application Assembler  Can define security information, or defer to deployer  Assembler defines:  Roles  Method permissions by role  Role reference resolution to actual role names  Definition of Roles: Allow access to employee payroll Payroll-Chief

creating competitive advantage Copyright © 2003 creating competitive advantage Responsibilities of Application Assembler  Definition of Method Permissions: Payroll-Chief Employees getSalary Employees setSalary...

creating competitive advantage Copyright © 2003 creating competitive advantage Responsibilities of Application Assembler  Definition of Role Reference Resolution: Employees... Needs access to update payroll info payroll-admin Payroll-Chief...

creating competitive advantage Copyright © 2003 creating competitive advantage Responsibilities of Deployer  Declare principals and roles in the security domain  Map DD roles to roles defined in the security domain  Configure principal delegation for inter-component calls  Create resource access policies and mappings

creating competitive advantage Copyright © 2003 Questions & Feedback?