Chapter 14. Security Management

This page discusses - Chapter 14. Security Management

Tutorials   
Chapter 5. Client View of an Entity Identify correct and incorrect statements about the Application Assembler's responsibilities, including the use of deployment descriptor elements related to transactions and the identifica Given a list of responsibilities, identify whose which are the Container's with respect to transactions, including the handling of getRollbackOnly, setRollbackOnly, getUserTransacti EJB Transactional Attributes Chapter 11. Transactions Given a list of scenarios, identify which will result in an ejbRemove method not being called on a bean instance. Given a list of responsibilities related to session beans, identify those which are the responsibility of the session bean provider and those which are the responsibility of the EJB contai Given a list of methods for a stateful or stateless session bean class, define which of the following operations can be performed from each of those methods: SessionContext interface metho Chapter 4. Session Bean Life Cycle Identify correct and incorrect statements or examples about the client view of a session bean's local and remote component interfaces. Identify the interface and method for each of the following: retrieve the session bean's remote home interface, retrieve the session bean's local component interface, determine if the sessio Match the correct description about purpose and function to which session bean type they apply: stateless, stateful, or both. Chapter 14. Security Management Given a security-related deployment descriptor tag, identify correct and incorrect statements and code related to that tag. Given a list of responsibilities, identify which belong to the deployer, bean provider, application assembler, container provider, system administrator, or any combination. From a list of responsibilities, identify which belong to the application assembler, bean provider, deployer, container provider, or system administrator. Part I. Exam Objectives Preface Identify the interfaces and methods a JMS message-driven bean must implement. Identify the use and behavior of the MessageDrivenContext interface methods. SCBCD Study Guide Given a list of responsibilities related to exceptions, identify those which are the bean provider's, and those which are the responsibility of the container provider. Be prepared to recog Given a particular method condition, identify the following: whether an exception will be thrown, the type of exception thrown, the container's action, and the client's view. Identify correct and incorrect statements or examples about application exceptions and system exceptions in entity beans, session beans, and message-driven beans. Identify correct and incorrect statements or examples about the client's view of exceptions received from an enterprise bean invocation. Identify correct and incorrect statements or examples about an entity bean's primary key and object identity. Identify the use, syntax, and behavior of, the following entity bean home method types, for Container-Managed Persistence (CMP); finder methods, create methods, remove methods, and home me Chapter 8. Entity Beans Chapter 13. Enterprise Bean Environment Chapter 2. Client View of a Session Bean Match EJB roles with the corresponding description of the role's responsibilities, where the description may include deployment descriptor information. Given a list, identify which are requirements for an EJB-jar file. Identify correct and incorrect statements or examples about the client view of a entity bean's remote component interface (EJBObject). Identify correct and incorrect conditional expressions, BETWEEN expressions, IN expressions, LIKE expressions, and comparison expressions. Identify correct and incorrect statements or examples about the purpose and use of EJB QL. Chapter 9. EJB-QL Identify correct and incorrect statements or examples about EJB programming restrictions. Chapter 1. EJB Overview Identify EJB 2.0 container requirements. Identify correct and incorrect statements or examples about the client view of an entity bean's local component interface (EJBLocalObject).

Ads

Ads

Chapter 14. Security Management

Identify correct and incorrect statements about the EJB support for security management including security roles, security role references, and method permissions.

Security roles

A SECURITY ROLE is a semantic grouping of permissions that a given type of users of the application must have in order to successfully use the application. The security roles defined by the Application Assembler present a simplified security view of the enterprise beans application to the Deployer - the Deployer's view of the application's security requirements is the small set of security roles rather than a large number of individual methods.

The Application Assembler can define one or more SECURITY ROLES in the deployment descriptor. The Application Assembler then assigns groups of methods of the enterprise beans' home and component interfaces to the security roles to define the security view of the application.

<!--
The security-role element contains the definition of a security role.
The definition consists of an optional description of the security
role, and the security role name.
Used in: assembly-descriptor
Example:

<security-role>
	<description>
		This role includes all employees who are authorized
		to access the employee service application.
	</description>
	<role-name>employee</role-name>
</security-role>
-->

<!ELEMENT security-role (description?, role-name)>

					

Because the Application Assembler does not, in general, know the security environment of the operational environment, the security roles are meant to be LOGICAL roles (or actors), each representing a type of user that should have the same access rights to the application.

The SECURITY ROLES defined by the security-role elements are scoped to the ejb-jar file level, and apply to ALL the enterprise beans in the ejb-jar file.

Security role references

The Bean Provider is responsible for DECLARING in the security-role-ref elements of the deployment descriptor all the security role names used in the enterprise bean code. Declaring the security roles REFERENCES in the CODE allows the Application Assembler or Deployer to LINK the names of the security roles used in the CODE to the security roles DEFINED for an assembled application through the security-role elements.

<!--
The security-role-ref element contains the declaration of a security
role reference in the enterprise bean's code. The declaration consists
of an optional description, the security role name used in the
code, and an optional link to a defined security role.
The value of the role-name element must be the String used as the
parameter to the EJBContext.isCallerInRole(String roleName) method.
The value of the role-link element must be the name of one of the
security roles defined in the security-role elements.
Used in: entity and session
-->

<!ELEMENT security-role-ref (description?, role-name, role-link?)>

					

The Bean Provider must declare each security role referenced in the code using the security-role-ref element as follows:

  • Declare the name of the security role using the role-name element. The name must be the security role name that is used as a parameter to the isCallerInRole(String roleName) method.

  • Optionally provide a description of the security role in the description element.

A security role reference, including the name defined by the role-name element, is scoped to the session or entity bean element whose declaration contains the security-role-ref element.

If the Application Assembler defines the security-role elements in the deployment descriptor, he or she is also responsible for linking all the security role references declared in the security-role-ref elements to the security roles defined in the security-role elements.

The Application Assembler LINKS each security role reference to a security role using the role-link element. The value of the role-link element must be the name of one of the security roles defined in a security-role element.

A role-link element must be used even if the value of role-name is the same as the value of the role-link reference.

Method permissions

The Applications Assembler can define (declaratively in the deployment descriptor) METHOD PERMISSIONS for each security role. A method permission is a permission to invoke a specified group of methods of the enterprise beans' home and component interfaces. If the Application Assembler has defined security roles for the enterprise beans in the ejb-jar file, he or she can also specify the methods of the home and component interfaces that each security role is allowed to invoke.

<!--
The method-permission element specifies that one or more security
roles are allowed to invoke one or more enterprise bean methods. The
method-permission element consists of an optional description, a list
of security role names or an indicator to specify that the methods are
not to be checked for authorization, and a list of method elements.
The security roles used in the method-permission element must be
defined in the security-role elements of the deployment descriptor,
and the methods must be methods defined in the enterprise bean's component
and/or home interfaces.
Used in: assembly-descriptor
-->

<!ELEMENT method-permission (description?, (role-name+|unchecked), method+)>

					

The Application Assembler defines the method permissions relation in the deployment descriptor using the method-permission elements as follows:

  • Each method-permission element includes a LIST of ONE or MORE security roles and a list of one or more methods. All the listed security roles are allowed to invoke all the listed methods. Each security role in the list is identified by the role-name element, and each method (or a set of methods, as described below) is identified by the method element. An optional description can be associated with a method-permission element using the description element.

  • The method permissions relation is defined as the union of all the method permissions defined in the individual method-permission elements.

  • A security role or a method may appear in multiple method-permission elements.

The Application Assembler can indicate that some methods should not be checked for authorization prior to invocation by the Container. The Application Assembler uses the unchecked element instead of a role name in the method-permission element to indicate that a method should not be checked for authorization.

Bean's security identity

In addition to specifying the security roles (or principals) that have access to an enterprise bean, the Application Assembler can also specify the run-as role for the entire enterprise bean. 'Run-as' defines the identity that a bean runs with when it calls other beans. This does not change the identity of the caller of the bean. The IDENTITY is configured using the security-identity element in the deployment descriptor. Because this is a per-bean setting, it must be declared for every EJB.

<!--
The security-identity element specifies whether the caller's security
identity is to be used for the execution of the methods of the enterprise
bean or whether a specific run-as identity is to be used. It
contains an optional description and a specification of the security
identity to be used.
Used in: session, entity, message-driven
-->

<!ELEMENT security-identity (description?, (use-caller-identity|
		run-as))>

					

Advertisements

Ads
Share on Google+Share on Google+

Chapter 14. Security Management

Posted on: April 18, 2011 If you enjoyed this post then why not add us on Google+? Add us to your Circles

Advertisements

 

Discuss: Chapter 14. Security Management  

Post your Comment


Your Name (*) :
Your Email :
Subject (*):
Your Comment (*):
  Reload Image
 
 
Comments:0

Ads

 

Ads