+

Search Tips   |   Advanced Search

Secure enterprise bean applications

We can protect enterprise bean methods by assigning security roles to them. Before we assign security roles, we need to know which EJB methods need protecting and how to protect them.

We can assign a set of EJB methods to a set of roles. When an EJB method is secured by associating a set of roles, grant at least one role in that set so that we can access that method. To exclude a set of EJB methods from access, mark the set excluded. We can give everyone access to a set of enterprise beans methods by clearing those methods. We can run enterprise beans as a different identity, using the runAs identity, before invoking other enterprise beans.

This procedure might not match the steps that are required when using the assembly tool, or match the version of the assembly tool that you are using. You should follow the instructions for the tool and version that you are using. For more information about using assembly tools see the assembly tool information center.

To secure enterprise bean applications:

  1. In an assembly tool, import the EJB Java Archive (JAR) file or an application archive (EAR) file containing one or more web modules.

    See the information about importing an EJB JAR file or importing an enterprise application EAR file in the Rational Application Developer documentation.

  2. In the Project Explorer, click EJB Projects directory and click the name of the application.

  3. Right-click the deployment descriptor and click Open with > Deployment Descriptor Editor. If we selected an enterprise bean .jar file, an EJB deployment descriptor editor opens. If we select an application .ear file, an application deployment descriptor editor opens. To see online information about the editor, press F1 and click the editor name.

  4. Create security roles. We can create security roles at the application level or at the EJB module level. If we create a security role at the EJB module level, the role displays in the application level. If a security role is created at the application level, the role does not display in all the EJB modules. We can copy and paste one or more EJB module security roles that we create at application level:

    • Create a role at an EJB module level. In an EJB deployment descriptor editor, click the Assembly tab. Under Security Roles, click Add. In the Add Security Role wizard, name and describe the security role and click Finish.

    • Create a role at the application level. In an application deployment descriptor editor, select the Security tab. Under the list of security roles, click Add. In the Add Security Role wizard, name and describe the security role; then click Finish.

  5. Create method permissions. Method permissions map one or more methods to a set of roles. An enterprise bean has four types of methods: home methods, remote methods, LocalHome methods and local methods. We can add permissions to enterprise beans on the method level. We cannot add a method permission to an enterprise bean unless you already have one or more security roles defined. For Version 2.0 EJB projects, an unselected option specifies that the selected methods from the selected beans do not require authorization to run. To add a method permission to an enterprise bean:

    1. On the Assembly tab of an EJB deployment descriptor editor, under Method Permissions, click Add. The Add Method Permission wizard is opened.

    2. Select a security role from the list of roles found and click Next.

    3. Select one or more enterprise beans from the list of beans found. We can click Select All or Deselect All to select or clear all of the enterprise beans in the list. Click Next.

    4. Select the methods to bind to the security role. The Method elements page lists all the methods associated with the enterprise beans. We can click Apply to All or Deselect All to quickly select or clear multiple methods. The selection affects the default (*) method for each bean only. Creating a method permission for the exact method signature overrides the default (*) method permission setting. The default (*) method represents all the methods within the bean. There are default (*) methods for each interface as well. By not selecting all of the individual methods in the tree, we can set other permissions on the remaining methods.

    5. Click Finish.
    After the method permission is created, we can see the new method permission in the tree. Expand the tree to see the bean and the methods defined in the method permission.

  6. Exclude user access to methods. Users cannot access excluded methods. Any method in the enterprise beans that is not assigned to a role or that is not excluded, is cleared during the application installation by the deployer.

    1. On the Assembly tab of an EJB deployment descriptor editor, under Excludes List, click Add. The Exclude List wizard is opened.

    2. Select one or more enterprise beans from the list of beans found and click Next.

    3. Select one or more of the method elements for the security identity and click Finish.

  7. Map the security-role-ref and role-name to the role-link. When developing enterprise beans, we can create the security-role-ref element. The security-role-ref element contains only the role-name field. The role-name field determines if the caller is in a specified role(isCallerInRole()) role and contains the name of the role referenced in the code. Because we create security roles during the assembly stage, the developer uses a logical role name in the role-name field and provides enough information in the Description field for the assembler to map the actual role (role-link). The security-role-ref element is located at the EJB level. Enterprise beans can have zero or more security-role-ref elements.

    1. On the Reference tab of an EJB deployment descriptor editor, under the list of references, click Add. The Add Reference wizard is opened.

    2. Select Security role reference and click Next.

    3. Name the security role reference, select a security role to link the reference to, describe the security role reference, and click Finish.

    4. Map every role-name used during development to the role (role-link) using the previous steps.

  8. Specify the RunAs identity for enterprise bean components. The RunAs identity of the enterprise bean is used to invoke the next enterprise beans in the chain of EJB invocations. When the next enterprise beans are invoked, the RunAsIdentity identity passes to the next enterprise beans for performing an authorization check on the next enterprise bean. If the RunAs identity is not specified, the client identity is propagated to the next enterprise bean. The RunAs identity can represent each of the enterprise beans or can represent each method in the enterprise beans.

    1. On the Access tab of an EJB deployment descriptor editor, next to the Security Identity (Bean Level) field, click Add. The Add Security Identity wizard is opened.

    2. Select the appropriate run as mode, describe the security identity, and click Next. Select the Use identity of caller mode to instruct the security service to not make changes to the credential settings for the principal. Select the Use identity assigned to specific role mode to use a principal assigned to the specified security role for running the bean methods. This association is part of the application binding in which the role is associated with the user ID and password of a user who is granted that role. If we select the Use identity assigned to specific role mode , specify a role name and role description.

    3. Select one or more enterprise beans from the list of beans found and click Next. If Next is unavailable, click Finish.

    4. Optional: On the Method elements page, select one or more of the method elements for the security identity and click Finish.

  9. Close the deployment descriptor editor and, when prompted, click Yes to save the changes.


Results

After securing an EJB application, the resulting .jar file contains security information in its deployment descriptor. The security information of the EJB modules is stored in the ejb-jar.xml file.


What to do next

After securing an EJB application using an assembly tool, we can install the EJB application using the console. During the installation of a secured EJB application, follow the steps in the topic, Deploying secured applications, to complete the task of securing the EJB application.


Related concepts

  • Role-based authorization
  • Delegations
  • Development and assembly tools


    Related tasks

  • Deploy secured applications

  • Security: Resources for learning