Head First EJB

The Application Assembler’s job: access control

The App Assembler knows the application. She knows what the methods do, and how they’re supposed to be used. The App Assembler knows the abstract roles that make sense logically, for this application. For example, she knows that there’s no need for a Marketing role in the payroll application. But she knows that there should be a least three levels of access for the app:

1. People who have full control and can both view and change an employee’s payroll data.

2. People who can read everything and modify some things.

3. People who can read some things, but can’t modify anything.

So her job is broken into two parts:

1. Define the roles

   • Figure out which roles makes sense in the application, and come up with names for these roles. Since the App Assembler might not be working in the real environment where the application will run, she’s just making up abstract names. In other words, her names don’t have to correspond to anything in the real world. For all we care, she could name the three roles Clown, Mime, and Juggler. As long as she can describe them well enough for the deployer to figure out which real people belong to those roles, it doesn’t matter that the names are made up.

   • In the deployment descriptor, define a <security-role> element for each role in the application.

   • In the deployment descriptor, use the <role-name> element to define the made-up name for ...