Enterprise JavaBeans 3.1, 6th Edition

Authorization

Once a user is authenticated by a vendor-specific mechanism, he must be checked to see if he is allowed to invoke a particular EJB method. Authorization is performed in Java EE and EJB by associating one or more roles with a given user and then assigning method permissions based on that role. While an example of a user might be “Carlo” or “Jaikiran,” roles are used to identify a group of users—for instance, “administrator,” “manager,” or “employee.” In EJB, you assign access control at method granularity. You do not assign these permissions on a per-user basis, but rather on a per-role basis. This allows the authentication process to remain a separate configuration from authorization.

The roles used to describe authorization are considered logical roles because they do not directly reflect users, groups, or any other security identities in a specific operational environment. EJB security roles are mapped to real-world user groups and users when the bean is deployed. This mapping allows a bean to be portable; every time the bean is deployed in a new system, the roles can be mapped to the users and groups specific to that operational environment.

Unlike authentication, authorization is something that the EJB specification clearly defines. You begin by declaring the roles that are accessed programmatically in your code base. Then, you assign permissions for each method in your class. This is done declaratively through Java annotations or through the ejb-jar.xml deployment ...