
Chapter 15. Security 475
The Java EE security policy describes how application resources are accessed. The
developer, when creating the application, has no information about real users of the
application. Instead, the developer defines
user roles, for example a client, clerk, or
manager. During development, the user roles are mapped to access rights. For example,
the user in the clerk role is allowed to access the registerNewClient method. The rule set
is stored in the descriptor files of the application. Then, when the application is deployed,
the deployer is responsible for mapping users and groups to the security roles.
CSIv2 security
CSIv2 ...