User and Role Common Uses of OPSS

20-2 Oracle Fusion Middleware Application Security Guide

20.2.2 The Java EE Authorization Model

The Java EE authorization model uses role membership to control access to EJB methods and web resources that are referenced by URLs; policies assign permissions to users and roles, and they are enforced by the container to protect resources. In the Java EE model, authorization is implemented in either of the following ways: ■ Declaratively, where authorization policies are specified in deployment descriptors; the container reads those policies from deployment descriptors and enforces them. No special application code is required to enforce authorization. ■ Programmatically, where authorization policies are checked in application code; the code checks whether a subject has the appropriate permission to execute specific sections of code. If the subject fails to have the proper permission, the code throws an exception. Table 20–1 shows the advantages and disadvantages of each approach. A container can provide authorization to applications running in it in two ways: declaratively and programmatically; these topics and an example are explained in the following sections: ■ Declarative Authorization ■ Programmatic Authorization ■ Java EE Code Example

20.2.2.1 Declarative Authorization

Declarative authorization allows to control access to URL-based resources such as servlets and pages and methods in EJBs. The basic steps to configure declarative authorization are the following:

1. In standard deployment descriptors, specify the resource to protect, such as a web

URL or an EJB method, and a logical role that has access to the resource. Alternatively, since Java EE 1.5 supports annotations, use code annotations instead of deployment descriptors.

2. In proprietary deployment descriptors such as web.xml, map the logical role

defined in step 1 to an enterprise group. For details, see the chapter Using Security Services in Oracle Fusion Middleware Enterprise JavaBeans Developers Guide for Oracle Containers for Java EE.

20.2.2.2 Programmatic Authorization

Programmatic authorization provides a finer grained authorization than the declarative approach, and it requires that the application code invoke the method Table 20–1 Comparing Authorization in the Java EE Model Authorization Type Advantages Disadvantages Declarative No coding needed; easy to update by modifying just deployment descriptors. Authorization is coarse-grained and specified at the URL level or at the method level for EJBs. Programmatic Specified in application code; can protect code at a finer levels of granularity. Not so easy to update, since it involves code changes and recompilation.