Martin: Created page with "References * http://java.boot.by/scea5-guide/ch08s04.html * [http://java.sun.com/xml/ns/javaee/ all schemas for j2ee] * [http://java.sun.com/xml/ns/javaee/javaee_5.xsd j2ee xs..."

2021-09-14T21:35:52Z

Created page with "References * http://java.boot.by/scea5-guide/ch08s04.html * [http://java.sun.com/xml/ns/javaee/ all schemas for j2ee] * [http://java.sun.com/xml/ns/javaee/javaee_5.xsd j2ee xs..."

New page

References
* http://java.boot.by/scea5-guide/ch08s04.html
* [http://java.sun.com/xml/ns/javaee/ all schemas for j2ee]
* [http://java.sun.com/xml/ns/javaee/javaee_5.xsd j2ee xsd (used by web.xsd)]

= Declarative security =
* rules and permissions
* defined in deployment descriptors
** EJB = ejb-jar.xml
** WAR = web.xml
** JAR = application-client.xml

= web.xml =
* [http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd web xsd]

Can configure protocol and roles of pages that can be seen
<web-app>
<security-constraint>
<web-resource-collection>
<url-pattern> </url-pattern>
<http-method>GET or POST</http-method>
</web-resource-collection>

<auth-constraint>
<role-name></role-name>
</auth-constraint>

<user-data-constraint>
<transport-guarantee>NONE (=http) or INTEGRAL (must not be tampered with = ssl) or CONFIDENTIAL (must not be intercepted = ssl)</transport-guarantee>
</user-data-constraint>
</security-constraint>
</web-app>

= ejb.xml =
[http://java.sun.com/xml/ns/javaee/ejb-jar_3_0.xsd ejb xsd]
* Can map roles to logical names for use within beans
* Can define roles the bean will run as
* Can define the roles required to access methods of beans
** can distinguish between methods overridden, interfaces - remote/local
** in assembly descriptor
* message driven only has security role to run as

<ejb-jar>
<enterprise-beans>
<entity|session>
<security-role-ref> < !-- only for use in security context methods within bean -- >
<role-name>Name to use in bean</role-name>
<role-link>actual role or logic role mapped by assembly descriptor</role-link>
</security-role-ref>

<security-identity>
* <use-caller-identity/> < !-- empty tag run as calling user -- >
* OR
* <run-as>
</security-identity>

...
<message-driven>
....
<security-identity>
* <use-caller-identity/> < !-- empty tag run as calling user -- >
* OR
* <run-as>
</security-identity>
<message-driven>

<assembly-descriptor>
<security-role-ref> < !-- see above -- > </security-role-ref>
<method-permission>
* <role-name></role-name>
* or
* <unchecked/>
<method>
<ejb-name></ejb-name>
<method-intf>optional - one of Home,Remote,LocalHome,Local,ServiceEndpoint</method-intf>
<method-name></method-name>
<method-params>optional - distinguish between overridden methods repeated with fully specified class</method-params>
</method>

Security and Deployment Descriptors - Revision history

Martin: Created page with "References * http://java.boot.by/scea5-guide/ch08s04.html * [http://java.sun.com/xml/ns/javaee/ all schemas for j2ee] * [http://java.sun.com/xml/ns/javaee/javaee_5.xsd j2ee xs..."