1
EJB 3.0 Security
Ye Wu
http://www.ise.gmu.edu/~wuye
SWE 645
Component-based Software Development
2007-4-3 © Dr. Ye Wu 2
EJB 3.0 Security Service
• Authentication
Authentication is the process of validating the identity of
a user who is trying to access a secured system.
• Authorization
Authorization can police a user’s access to subsystems,
data and business objects, or it can monitor more general
behavior
• Confidentiality and integrity protection
Data transfer should be protected and attackers should
not be able to read or modify this data in transit.
2007-4-3 © Dr. Ye Wu 3
Authentication and Identity
• EJB specification does not specify how
authentication happens
• EJB specification does not specify how the client
is supposed to obtain and associate identity and
credentials with an EJB invocation.
• EJB defines how security information is
propagated from a client to the server.
2007-4-3 © Dr. Ye Wu 4
Authentication and Identity
properties.setProperty
properties.setProperty(
(
Context.
Context.INITIAL_CONTEXT_FACTORY
INITIAL_CONTEXT_FACTORY,
,
"
"org.jboss.security.jndi.JndiLoginInitial ContextFactory
org.jboss.security.jndi.JndiLoginInitial ContextFactory");
");
properties.put
properties.put(
(
Context.
Context.URL_PKG_PREFIXES
URL_PKG_PREFIXES,
,
"
"org.jboss.naming:org.jnp.interfaces
org.jboss.naming:org.jnp.interfaces");
");
properties.put(Context.
properties.put(Context.PROVIDER_URL
PROVIDER_URL,
,
"jnp://localhost:1099");
"jnp://localhost:1099");
properties.setProperty
properties.setProperty(
(
Context.
Context.SECURITY_PRINCIPAL
SECURITY_PRINCIPAL, "admin");
, "admin");
properties.setProperty
properties.setProperty(
(
Context.
Context.SECURITY_CREDENTIALS
SECURITY_CREDENTIALS, "password");
, "password");
2007-4-3 © Dr. Ye Wu 5
Authorization
Authorization is performed in Java EE and EJB by
associating one or more roles with a given user and
then assigning method permissions based on that role.
The roles used to describe authorization are considered
logical roles because they do not directly reflect users,
groups, or any other security identities in a specific
operational environment.
Authorization is clearly defined in EJB specification
2007-4-3 © Dr. Ye Wu 6
Assigning Method Permissions
import org.jboss.annotation.security.SecurityDomain;
import javax.annotation.security.PermitAll;
import javax.annotation.security.RolesAllowed;
@Stateless
@SecurityDomain("other")
public class StatelessEJB implements StatelessRemote {
@PermitAll
public void addFunds(double amount) {… …}
@RolesAllowed( { "admin" })
public void withdrawFunds(double amount) throws InsufficientBalanceException
{… …}
}
Users.properties
User=password
Roles.properties
User=user_role
