Although it is an optional feature, when EJB security is configured in the connector, it requires that the connector provide authentication and access control data to the application server, before it can access any secure beans deployed on the server. The connector for EJB architecture uses the Java Authentication and Authorization Service (JAAS) to implement EJB security.
JAAS is a security framework that enables services to authenticate and enforce access controls based on user identity. It implements a Java version of the standard Pluggable Authentication Module (PAM) framework, and supports user-based authorization. JAAS authorization allows you to grant permissions based not on just what code is running but also on who is running it.
JAAS authentication is performed in a pluggable fashion. This allows Java applications to remain independent from underlying authentication technologies, allowing new or updated authentication technologies to be plugged under an application without requiring modifications to the application itself.
For details about security, see Configuring security.