Configuring security

EJB security in the connector is optional, and only available if the application server on which the enterprise beans are deployed supports secure beans and the security protocol you choose. If you do enable security, it requires that the user (in this case, the connector) provide authentication data to the application server to access any deployed beans. Security can be enabled in the EJB connector using the Java Authentication and Authorization Service (JAAS) only if your application server supports this security technology.

Assigning method permissions to security roles

The connector relies on access control to ensure that users only access resources for which they have been given permission. Access control applies security policies that regulate what a specific user can and cannot do within a system. The security roles for the enterprise beans in the EJB JAR file specify the methods of the home and remote interfaces that each security role is allowed to invoke. The deployment descriptor file includes tags that declare which logical roles are allowed to access which bean methods at runtime.

The following sample code illustrates how security roles are assigned method permissions in the deployment descriptor. Notice that for each role listed in the deployment descriptor, the methods that can be invoked are grouped by bean name.

<method-permission>
         <role-name>payroll_department</role-name>
         <method>
                 <ejb-name>EmployeeService</ejb-name>
                 <method-name>*</method-name>
         </method>
 </method-permission>
 <method-permission>
         <role-name>employee</role-name>
         <method>
                 <ejb-name>AardvarkPayroll</ejb-name>
                 <method-name>findByPrimaryKey</method-name>
         </method>
         <method>
                 <ejb-name>AardvarkPayroll</ejb-name>
                 <method-name>getEmployeeInfo</method-name>
         </method>
         <method>
                 <ejb-name>AardvarkPayroll</ejb-name>
                 <method-name>updateEmployeeInfo</method-name>
         </method>
 </method-permission>
 <method-permission>
 

Using the Java Authentication and Authorization Service (JAAS)

If your application server supports the Java Authentication and Authorization Service (JAAS), you can use it to implement EJB security using this service. When the user or client (in this case, the connector) attempts to access a secure bean deployed on an application server, JAAS verifies the user and that user's permissions. In doing so, JAAS provides an additional level of security to the application server on which an enterprise bean is deployed. JAAS requires specifying a LoginContext, LoginModule, and other J2EE classes that describe the basic methods used to authenticate a client. For additional information about these classes, see LoginConfiguration.

Since the connector for EJB acts as a client of the server, when security is enabled in the EJB environment, the connector must provide user authentication data in the form of a user ID (JAASUserName configuration property of the connector) and password (JAASPassword configuration property). The EJB container examines the identity or role passed by the connector, and compares it with the list of identity objects associated with the method as defined in the deployment descriptor. If the caller identity from the connector matches a caller identity associated with the method, then the method can be invoked.

Authentication validates the identity of the user (in this case, the connector). Once the user has successfully passed through the authentication system, it is free to access and invoke the methods for which it has permissions.

The connector properties that control EJB security using JAAS are LoginConfiguration, CallBackHandlerClass, JAASUserName, JAASPassword, and JAASRealm. The values you enter in these properties are entirely dependent on your application server. For details about how the connector uses these properties, see Connector-specific properties. For details about the values to enter in the properties, see your application server documentation.

Configuring JAAS in the connector startup file

For the connector to work with JAAS, you must make the following changes to the connector startup file (start_EJB.bat or start_EJB.sh):

Copyright IBM Corp. 1997, 2004