EJB3.0 Security

Authorization - Once a user is authenticated by a vendor-specific mechanism, he must be checked to see if he is allowed to invoke a particular EJB method. Authorization is performed in Java EE and EJB by associating one or more roles with a given user and then assigning method permissions based on that role. While an example of a user might be "Scott" or "Gavin," roles are used to identify a group of usersfor instance, "administrator," "manager," or "employee." In EJB, you assign access control on a per-method basis.

import javax.ejb.*;
import javax.annotation.Resource;
import javax.annotation.security.*;

@Stateless
@RolesAllowed("AUTHORIZED_TRAVEL_AGENT")
public class ProcessPaymentBean implements ProcessPaymentRemote,
ProcessPaymentLocal
{
...
@PermitAll
public boolean byCash(Customer customer, double amount)
throws PaymentException
{
...
}
@RolesAllowed("CHECK_FRAUD_ENABLED")
public boolean byCheck(Customer customer, CheckDO check, double amount)
throws PaymentException
{
...
}

public boolean byCredit(Customer customer, CreditCardDO card,
double amount) throws PaymentException
{
...
}
private boolean process(int customerID, double amount, String type,
String checkBarCode, int checkNumber, String creditNumber,
java.sql.Date creditExpDate) throws PaymentException
{
...
}
}

You can also specify this security metadata with XML :

<ejb-jar version="3.0">
<assembly-descriptor>
<security-role>
<description>This role represents an authorized merchant</description>
<role-name>AUTHORIZED_MERCHANT</role-name>
</security-role>
<security-role>
<description>
This role represents a merchant that has check fraud enabled
</descripton>
<role-name>CHECK_FRAUD_ENABLED</role-name>
</security-role>
<method-permission>
<role-name>AUTHORIZED_MERCHANT</role-name>
<method>
<ejb-name>ProcessPaymentBean</ejb-name>
<method-name>byCredit</method-name>
</method>
</method-permission>
<method-permission>
<role-name>CHECK_FRAUD_ENABLED</role-name>
<method>
<ejb-name>ProcessPaymentBean</ejb-name>
<method-name>byCheck</method-name>
</method>
</method-permission>
<method-permission>
<unchecked/>
<method>
<ejb-name>ProcessPaymentBean</ejb-name>
<method-name>byCheck</method-name>
</method>
</method-permission>
</assembly-descriptor>
</ejb-jar>