Architecting Modern Java EE Applications

Java principals and roles

Java security principals and roles represent identities and authorization roles, respectively. Principals and roles are usually configured in the application server in vendor-specific ways. Authenticated requests are bound to a principal during the execution.

One example of using the associated roles within the execution workflow is by using common security annotations such as @RolesAllowed. This declarative approach checks whether the principal is authorized correctly and will otherwise result in a security exception:

import javax.annotation.security.RolesAllowed;@Stateless
public class CarManufacturer {

    ...

    @RolesAllowed("worker")
    public Car manufactureCar(Specification spec) {
        ...
    }

    @RolesAllowed("factory-admin") ...