A Case Study of the EJB Security: Combining Declarative, Role-Based Access Control with Programmatic Application-Specific Proxy Security Checks

摘要

The Java Enterprise Bean (EJB) specification specifies a declarative, role-based access control. The use of the role-based control allows the separation of the EJB business code from the security code. Although this method-shifts the most burdens on security to deployers who implement the security policy on the Java 2 Enterprise Edition (J2EE) application server, there are some application-specific security checks where security policy has something to do with EJB's business logic and cannot be handled by the role-based control approach. A case study that combines the role-based control and application-specific security checks is presented in this study.