Oracle ADF Authorization Common Uses of OPSS

20-2 Oracle Fusion Middleware Application Security Guide

20.2.2 The Java EE Authorization Model

The Java EE authorization model uses role membership to control access to EJB methods and web resources that are referenced by URLs; policies assign permissions to users and roles, and they are enforced by the container to protect resources. In the Java EE model, authorization is implemented in either of the following ways: ■ Declaratively, where authorization policies are specified in deployment descriptors; the container reads those policies from deployment descriptors and enforces them. No special application code is required to enforce authorization. ■ Programmatically, where authorization policies are checked in application code; the code checks whether a subject has the appropriate permission to execute specific sections of code. If the subject fails to have the proper permission, the code throws an exception. Table 20–1 shows the advantages and disadvantages of each approach. A container can provide authorization to applications running in it in two ways: declaratively and programmatically; these topics and an example are explained in the following sections: ■ Declarative Authorization ■ Programmatic Authorization ■ Java EE Code Example

20.2.2.1 Declarative Authorization

Declarative authorization allows to control access to URL-based resources such as servlets and pages and methods in EJBs. The basic steps to configure declarative authorization are the following:

1. In standard deployment descriptors, specify the resource to protect, such as a web

URL or an EJB method, and a logical role that has access to the resource. Alternatively, since Java EE 1.5 supports annotations, use code annotations instead of deployment descriptors.

2. In proprietary deployment descriptors such as web.xml, map the logical role

defined in step 1 to an enterprise group. For details, see the chapter Using Security Services in Oracle Fusion Middleware Enterprise JavaBeans Developers Guide for Oracle Containers for Java EE.

20.2.2.2 Programmatic Authorization

Programmatic authorization provides a finer grained authorization than the declarative approach, and it requires that the application code invoke the method Table 20–1 Comparing Authorization in the Java EE Model Authorization Type Advantages Disadvantages Declarative No coding needed; easy to update by modifying just deployment descriptors. Authorization is coarse-grained and specified at the URL level or at the method level for EJBs. Programmatic Specified in application code; can protect code at a finer levels of granularity. Not so easy to update, since it involves code changes and recompilation. The OPSS Policy Model 20-3 isUserInRole for servlets and JSPs or the method isCallerInRole for EJBs, both available from standard Java APIs. Although these methods still depend on role membership to determine authorization, they give finer control over authorization decisions since the controlling access is not limited at the resource level EJB method or URL.

20.2.2.3 Java EE Code Example

The following example illustrates a servlet calling the method isUserInRole. It is assumed that the EAR file packing the servlet includes the configuration files web.xml and weblogic-application.xml, and that these files include the following configuration fragments: web.xml -- security roles -- security-role role-namesr_developerrole-name security-role weblogic-application.xml The following snippet shows the mapping between the user weblogic and the security role sr_developer: wls:security-role-assignment wls:role-namesr_developerwls:role-name wls:principal-nameweblogicwls:principal-name wls:security-role-assignment Code Example Invoking isUserInRole import javax.servlet.ServletConfig; import javax.servlet.ServletException; import javax.servlet.ServletOutputStream; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; import java.util.Date; public class PolicyServlet extends HttpServlet { public PolicyServlet { super; } public void initServletConfig config throws ServletException { super.initconfig; } public void doGetHttpServletRequest request, HttpServletResponse response throws ServletException, IOException { final ServletOutputStream out = response.getOutputStream; response.setContentTypetexthtml; out.printlnHTMLBODY bgcolor=\FFFFFF\; out.printlnTime stamp: + new Date.toString; out.println brrequest.getRemoteUser = + request.getRemoteUser + br;