298
J2EE Platform Security Model
Declarative references in the deployment descriptor, rather than program
code, define much of the security for a J2EE application. The collection of secu 
rity declarations forms the security policy for an application. When security is
defined declaratively, the container is responsible for performing security and the
application does not include code specifically for security operations. Since secu 
rity references are in the deployment descriptor, developers can modify the secu 
rity for an application by using tools or changing the deployment descriptor. At
deployment, the container uses the application security policy declared in the
deployment descriptor to set up the security environment for the J2EE application,
just as it uses other references in the deployment descriptor to perform similar ser 
vices for transactions, remote communication, and so forth. During runtime, the
container interposes itself between the client calls and the application's compo 
nents to perform security checks and otherwise manage the applications. 
In addition to declarative security, the J2EE platform includes APIs to add
security code into your components. 
Programmatic security
 refers to security
decisions that are made by security aware applications. Programmatic security,
which allows an application to include code that explicitly uses a security mecha 
nism, is useful when declarative security alone cannot sufficiently express the
security model of an application. The J2EE programming model offers some pro 
grammatic services that help you to write security functionality into the application
code.
As noted, rather than inventing new security mechanisms, the J2EE platform
facilitates the incorporation of existing security mechanisms into an application
server operational environment. That is, the J2EE security model integrates with
existing authorization and authentication mechanisms, handling existing user
identity information, digital certificates, and so forth. The model provides a unify 
ing layer above other security services, and its coherent programming model hides
the security implementation details from application developers. For example, the
J2EE security model provides mechanisms to leverage existing Internet security
standards such as Secure Sockets Layer (SSL).
In addition, the J2EE platform security model gives you the ability to provide
security boundaries. Once you have established these security boundaries, you can
map users to their organizational roles and combine users into logical groups
according to these roles.
Let's look in more detail at the J2EE platform security services and mecha 
nisms. This security model applies to Web services as well as to the entire J2EE
platform.  Security for Web Service Interactions  on page 308 describes how a
Web service application can leverage these J2EE security mechanisms. 






footer




 

 

 

 

 Home | About Us | Network | Services | Support | FAQ | Control Panel | Order Online | Sitemap | Contact

 

Our web partners: Inexpensive Web Hosting Java Web Hosting personal webspace webspace php  linux webhost

 html web templates DreamweaverQuality Web Templates PSD Web Templates

cheap webhost j2ee web Hosting buy webspace ftp webspace adult webspace

frontpage WebHosting webspace hosting cheap webhost

Visionwebhosting.net Business web hosting division of Vision Web Hosting Inc.. All rights reserved

aol web hosting