Beispiel: JBoss-spezifische Security

@Entity ()
@Table(name="BENUTZER")
public class BenutzerBean implements Serializable
{
  private static final long serialVersionUID = 1L;

  private Integer intId;
  private String strLogin;
  private String strPasswort;
  
  private Collection<RolleBean> rollen;
  
  @Id
  @Column(name="ID")
  @GeneratedValue
  public Integer getId()
  {
    return this.intId;
  }
  
  public void setId (Integer int_Id)
  {
    this.intId = int_Id;
  }
  
  @Column(name="LOGIN")
  public String getLogin()
  {
    return this.strLogin;
  }

  public void setLogin (String str_Login)
  {
    this.strLogin = str_Login;
  }

  @Column(name="PASSWORT")
  public String getPasswort()
  {
    return this.strPasswort;
  }

  public void setPasswort(String str_Passwort)
  {
    this.strPasswort = str_Passwort;
  }
  
  @ManyToMany()
  @JoinTable (name="BENUTZER_ROLLE", 
    joinColumns={@JoinColumn(name="BENUTZER_ID") },
    inverseJoinColumns={@JoinColumn(name="ROLLEN_ID") })
  public Collection<RolleBean> getRollen()
  {
    return this.rollen;
  }
  
  public void setRollen (Collection<RolleBean> rollen)
  {
    this.rollen = rollen;
  }
}
 

@Entity ()
@Table(name="ROLLE")
public class RolleBean implements Serializable
{
  private static final long serialVersionUID = 1L;

  private Integer intId;
  private String strRolle;
  
 
  @Id
  @Column(name="ID")
  @GeneratedValue
  public Integer getId()
  {
    return this.intId;
  }
  
  public void setId (Integer int_Id)
  {
    this.intId = int_Id;
  }
  
  @Column(name="ROLLE")
  public String getRolle()
  {
    return this.strRolle;
  }
  
  public void setRolle(String str_Rolle)
  {
    this.strRolle = str_Rolle;
  }
} 

@Stateless
@DeclareRoles(value={"administrator", "kunde"})
@SecurityDomain(value="knaufsecurity")
public class SecuredBean implements Secured
{
  private static final Logger logger = Logger.getLogger (SecuredBean.class.getName() );

  @PersistenceContext(unitName="securityPersistenceUnit")
  private EntityManager entityManager = null;

  @Resource()
  private SessionContext sessionContext = null;

  @RolesAllowed(value={"administrator"} )
  public void forAdminOnly()
  {
    logger.info("forAdminOnly");
  }

  @RolesAllowed(value={"kunde"} )
  public void forKundeOnly()
  {
    logger.info("forKundeOnly");
  }

  @RolesAllowed(value={"administrator", "kunde"} )
  public void forBoth()
  {
    logger.info("forBoth");
	
    logger.info ("Caller: '" + this.sessionContext.getCallerPrincipal().getName() +"'");
    logger.info ("Caller in Rolle 'kunde' ? " + this.sessionContext.isCallerInRole("kunde"));
    logger.info ("Caller in Rolle 'administrator' ? " + this.sessionContext.isCallerInRole("administrator"));
    
    //Jetzt einen Datenbankzugriff versuchen:
    Query query =this.entityManager.createQuery("select o from BenutzerBean o");
    List<BenutzerBean> listBenutzer = query.getResultList();
    Iterator<BenutzerBean> iteratorBenutzer = listBenutzer.iterator();
    while (iteratorBenutzer.hasNext() == true)
    {
      BenutzerBean benutzerAktuell = iteratorBenutzer.next();
      logger.info("Benutzer-Login: '" + benutzerAktuell.getLogin() + "'");
    }
  }
}

<?xml version="1.0" encoding="UTF-8"?>
<persistence xmlns="http://java.sun.com/xml/ns/persistence"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_1_0.xsd"
	version="1.0">
	<persistence-unit name="securityPersistenceUnit">
		<jta-data-source>java:/DefaultDS</jta-data-source>
		<properties>
			<!-- Setzen dieser Property aktiviert das automatische Tabellen-Generieren und Löschen beim Deploy! -->
			<property name="hibernate.hbm2ddl.auto" value="create-drop" />
			<!-- SQL-Logging einschalten: -->
			<property name="hibernate.show_sql" value="true"></property>
		</properties>
	</persistence-unit>
</persistence>

insert into rolle (id, rolle) values (1,  'administrator');
insert into rolle (id,  rolle) values (2,  'kunde');
insert into rolle (id,  rolle) values (3,  'gast');

insert into benutzer (id, login, passwort) values (1, 'admin', 'admin');
insert into benutzer (id, login, passwort) values (2, 'kunde', 'kunde');
insert into benutzer (id, login, passwort) values (3, 'gast', 'gast');

insert into benutzer_rolle (benutzer_id, rollen_id) values (1, 1);
insert into benutzer_rolle (benutzer_id, rollen_id) values (2, 2);
insert into benutzer_rolle (benutzer_id, rollen_id) values (3, 3);

22:54:52,371 INFO  [SchemaExport] Running hbm2ddl schema export
22:54:52,371 INFO  [SchemaExport] exporting generated schema to database
22:54:52,371 INFO  [SchemaExport] Executing import script: /import.sql
22:54:52,371 INFO  [SchemaExport] schema export complete 

<application-policy name="knaufsecurity">
	<authentication>
		<login-module
			code="org.jboss.security.auth.spi.DatabaseServerLoginModule"
			flag="required">
			<module-option name="unauthenticatedIdentity">
				gast
			</module-option>
			<module-option name="dsJndiName">
				java:/DefaultDS
			</module-option>
			<module-option name="principalsQuery">
				SELECT PASSWORT FROM BENUTZER WHERE LOGIN=?
			</module-option>
			<module-option name="rolesQuery">
				SELECT R.ROLLE, 'Roles' FROM ROLLE AS R, BENUTZER_ROLLE
				AS BR, BENUTZER AS B WHERE B.LOGIN=? AND BR.ROLLEN_ID
				= R.ID AND BR.BENUTZER_ID = B.ID
			</module-option>
		</login-module>
	</authentication>
</application-policy> 

<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" xmlns="http://java.sun.com/xml/ns/javaee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
	version="2.5">
	<display-name>SecurityWeb</display-name>
	<welcome-file-list>
		<welcome-file>index.html</welcome-file>
		<welcome-file>index.htm</welcome-file>
		<welcome-file>index.jsp</welcome-file>
		<welcome-file>default.html</welcome-file>
		<welcome-file>default.htm</welcome-file>
		<welcome-file>default.jsp</welcome-file>
	</welcome-file-list>

	<security-constraint>
		<display-name>Security Constraint für SecurityWeb</display-name>
		<web-resource-collection>
			<web-resource-name>Alles</web-resource-name>
			<url-pattern>/*</url-pattern>
			<http-method>GET</http-method>
			<http-method>POST</http-method>
		</web-resource-collection>
		<auth-constraint>
			<description>Administrator und Kunde dürfen auf diese Seite zugreifen</description>
			<role-name>administrator</role-name>
			<role-name>kunde</role-name>
		</auth-constraint>
	</security-constraint>
	<login-config>
		<auth-method>FORM</auth-method>
		<form-login-config>
			<form-login-page>/login.jsp</form-login-page>
			<form-error-page>/error.jsp</form-error-page>
		</form-login-config>
	</login-config>
	<security-role>
		<description>Administrator im Web</description>
		<role-name>administrator</role-name>
	</security-role>
	<security-role>
		<description>Kunde im Web</description>
		<role-name>kunde</role-name>
	</security-role>

	<ejb-ref>
		<ejb-ref-name>ejb/Secured</ejb-ref-name>
		<ejb-ref-type>Session</ejb-ref-type>
		<home>java.lang.Object</home>
		<remote>de.fhw.swtvertiefung.knauf.security.Secured</remote>
	</ejb-ref>
</web-app> 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE jboss-web PUBLIC
    "-//JBoss//DTD Web Application 4.2//EN"
    "http://www.jboss.org/j2ee/dtd/jboss-web_4_2.dtd">

<jboss-web>
	<security-domain>java:/jaas/knaufsecurity</security-domain>
	<context-root>SecurityWeb</context-root>

	<!-- EJB References -->
	<ejb-ref>
		<ejb-ref-name>ejb/Secured</ejb-ref-name>
		<jndi-name>Security/SecuredBean/remote</jndi-name>
	</ejb-ref>
</jboss-web>

   <form method="post" ACTION="j_security_check">
      Login: <input type="text" name="j_username" /> <br>
      Passwort: <input type="password" name="j_password" /> <br>
      <input type="submit" name="login" value="Login">
   </form> 

   <FORM METHOD=POST ACTION="logout.jsp" NAME="logout">
      <input type="submit" name="logout" value="Logout">
   </FORM> 

  <%
    //Session beenden:
    session.invalidate(); 
  %>
  <P>Sie wurden abgemeldet ! </P>
  <a href="index.jsp">Zurück zur Startseite</a> 

<?xml version="1.0" encoding="UTF-8"?>
<application-client id="Application-client_ID" version="5" xmlns="http://java.sun.com/xml/ns/javaee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/application-client_5.xsd">

	<display-name>SecurityClient</display-name>

	<ejb-ref>
		<ejb-ref-name>ejb/Secured</ejb-ref-name>
		<ejb-ref-type>Session</ejb-ref-type>
		<home>java.lang.Object</home>
		<remote>de.fhw.swtvertiefung.knauf.security.Secured</remote>
	</ejb-ref>

</application-client> 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE jboss-client PUBLIC "-//JBoss//DTD Application Client 4.0//EN" "http://www.jboss.org/j2ee/dtd/jboss-client_4_0.dtd" >
<jboss-client>
	  <jndi-name>SecurityClient</jndi-name>
	  <ejb-ref>
		<ejb-ref-name>ejb/Secured</ejb-ref-name>
		<jndi-name>Security/SecuredBean/remote</jndi-name>
	</ejb-ref>
</jboss-client>

knaufclientsecurity {
   // jBoss LoginModule
   org.jboss.security.ClientLoginModule  required
   ;
}; 

public class SecurityClientCallbackHandler implements CallbackHandler
{
  public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException
  {
    //Über alle übergebenen Callbacks iterieren:
    for (int intIndexCallback = 0; intIndexCallback < callbacks.length; intIndexCallback++)
    {
      //NameCallback: Login übergeben.
      if (callbacks[intIndexCallback] instanceof NameCallback)
      {
        NameCallback nameCallback = (NameCallback) callbacks[intIndexCallback];
        nameCallback.setName( "ADMIN" );
      }
      //PasswordCallback: Login übergeben.
      else if (callbacks[intIndexCallback] instanceof PasswordCallback)
      {
        PasswordCallback passwordCallback = (PasswordCallback) callbacks[intIndexCallback];
        passwordCallback.setPassword ("ADMIN".toCharArray() );
      }
      else
      {
        throw new UnsupportedCallbackException (callbacks[intIndexCallback], "Nicht unterstützer Callback !");
      }
    }
  }
}

      Properties props = new Properties();
      props.setProperty(Context.INITIAL_CONTEXT_FACTORY, "org.jnp.interfaces.NamingContextFactory");
      props.setProperty(Context.URL_PKG_PREFIXES, "org.jboss.naming.client");
      props.setProperty(Context.PROVIDER_URL, "jnp://localhost:1099");
      props.setProperty("j2ee.clientName", "SecurityClient");
      
      InitialContext initialContext = new InitialContext(props);
      
      //Login initialisieren:
      SecurityClientCallbackHandler callbackHandler = new SecurityClientCallbackHandler();
      LoginContext loginContext = new LoginContext ("knaufclientsecurity", callbackHandler);
      loginContext.login(); 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE jboss-app
    PUBLIC "-//JBoss//DTD J2EE Application 4.2//EN"
    "http://www.jboss.org/j2ee/dtd/jboss-app_4_2.dtd">

<jboss-app>
    <security-domain>java:/jaas/knaufsecurity</security-domain>

</jboss-app> 

<?xml version="1.0" encoding="UTF-8"?>
<ejb-jar id="ejb-jar_ID" version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
                           http://java.sun.com/xml/ns/javaee/ejb-jar_3_0.xsd">
	<display-name>SecurityEJB</display-name>
	<enterprise-beans>
		<session>
			<description>
				<![CDATA[Die Methoden dieser Session-Bean sind für unterschiedliche Rollen zugelassen.]]>
			</description>
			<display-name>SecuredBean</display-name>

			<ejb-name>SecuredBean</ejb-name>

			<remote>de.fhw.swtvertiefung.knauf.security.Secured</remote>
			<ejb-class>de.fhw.swtvertiefung.knauf.security.SecuredBean</ejb-class>
			<session-type>Stateless</session-type>
			<transaction-type>Container</transaction-type>

			<!--EntityManager-Injection -->
			<persistence-context-ref>
				<persistence-context-ref-name>
					SecurityPersistenceUnitRef
				</persistence-context-ref-name>
				<persistence-unit-name>securityPersistenceUnit</persistence-unit-name>
				<injection-target>
					<injection-target-class>
						de.fhw.swtvertiefung.knauf.security.SecuredBean
					</injection-target-class>
					<injection-target-name>entityManager</injection-target-name>
				</injection-target>
			</persistence-context-ref>

			<!--SessionContext-Injection -->
			<resource-ref>
				<res-ref-name>EgalWasHierSteht</res-ref-name>
				<mapped-name>java:comp/EJBContext</mapped-name>
				<injection-target>
					<injection-target-class>de.fhw.swtvertiefung.knauf.security.SecuredBean</injection-target-class>
					<injection-target-name>sessionContext</injection-target-name>
			  	</injection-target>
			</resource-ref>

		</session>
		<!-- Entity Beans -->
		<entity>
			<description>
				<![CDATA[Entity-Bean für einen Benutzer.]]>
			</description>
			<display-name>BenutzerBean</display-name>

			<ejb-name>BenutzerBean</ejb-name>

			<ejb-class>de.fhw.swtvertiefung.knauf.security.BenutzerBean</ejb-class>
			<persistence-type>Container</persistence-type>
			<prim-key-class>java.lang.Integer</prim-key-class>
			<reentrant>false</reentrant>
		</entity>

	</enterprise-beans>

	<assembly-descriptor>
		<security-role>
			<description>
				<![CDATA[Rolle "Kunde"]]>
			</description>
			<role-name>kunde</role-name>
		</security-role>
		<security-role>
			<description>
				<![CDATA[Rolle "Administrator"]]>
			</description>
			<role-name>administrator</role-name>
		</security-role>


		<method-permission>
			<role-name>administrator</role-name>
			<method>
				<description>
					<![CDATA[Diese Methode darf nur vom Admin aufgerufen werden !]]>
				</description>
				<ejb-name>SecuredBean</ejb-name>
				<method-intf>Remote</method-intf>
				<method-name>forAdminOnly</method-name>
				<method-params></method-params>
			</method>
		</method-permission>
		<method-permission>
			<role-name>kunde</role-name>
			<method>
				<description>
					<![CDATA[Diese Methode darf nur vom Kunden aufgerufen werden !]]>
				</description>
				<ejb-name>SecuredBean</ejb-name>
				<method-intf>Remote</method-intf>
				<method-name>forKundeOnly</method-name>
				<method-params></method-params>
			</method>
		</method-permission>
		<method-permission>
			<role-name>administrator</role-name>
			<role-name>kunde</role-name>
			<method>
				<description>
					<![CDATA[Diese Methode darf von Admin und Kunde aufgerufen werden !]]>
				</description>
				<ejb-name>SecuredBean</ejb-name>
				<method-intf>Remote</method-intf>
				<method-name>forBoth</method-name>
				<method-params></method-params>
			</method>
		</method-permission>
	</assembly-descriptor>
</ejb-jar>  

• Deklaration der im Deployment Deskriptor verwendeten Rollen durch ein Element "security-role" (entspricht der Annotation @DeclaredRoles in der Bean).
  
  
• Festlegen der Methodenberechtigungen durch Elemente "method-permission" (entspricht der Annotation @RolesAllowed in der Bean). Hier muss man extrem vorsichtig sein da bei einem Tippfehler z.B. im Bean-Namen keine Fehlermeldungen kommen.
  
  
• Injection des SessionContexts: hier gibt es zwei Besonderheiten:
  a) das XML-Pflichtelement <res-ref-name> kann hier einen beliebigen Wert haben, denn da wir uns den SessionContext nicht per JNDI-Lookup selbst holen wollen, ist es egal unter welchem Namen er im JNDI zur Verfügung gestellt wird.
  b) Der SessionContext steht automatisch im globalen JNDI unter dem Namen java:comp/EJBContext zur Verfügung (auch wenn er nicht im JNDI-View auftaucht), auf diesen Namen verweist unsere <resource-ref>. Ohne dieses Element gibt es Deploy-Fehler.
  
  

<?xml version="1.0" encoding="UTF-8"?>
<entity-mappings xmlns="http://java.sun.com/xml/ns/persistence/orm"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://java.sun.com/xml/ns/persistence/orm http://java.sun.com/xml/ns/persistence/orm_1_0.xsd"
	version="1.0">

	<entity class="de.fhw.swtvertiefung.knauf.security.BenutzerBean" access="PROPERTY"
	 metadata-complete="true">
		<table name="BENUTZER"></table>
		<attributes>
			<id name="id">
				<column name="ID" /> 
				<generated-value/>
			</id>
			<basic name="login">
				<column name="LOGIN" />
			</basic>
			<basic name="password">
				<column name="PASSWORD" />
			</basic>
			<many-to-many name="rollen" target-entity="de.fhw.swtvertiefung.knauf.security.RolleBean">
				<join-table name="BENUTZER_ROLLE">
					<join-column name="BENUTZER_ID"/>
					<inverse-join-column name="ROLLEN_ID"/>
				</join-table>
			</many-to-many>
		</attributes>
	</entity>
	
	<entity class="de.fhw.swtvertiefung.knauf.security.RolleBean" access="PROPERTY"
	 metadata-complete="true">
		<table name="ROLLE"></table>
		<attributes>
			<id name="id">
				<column name="ID" /> 
				<generated-value/>
			</id>
			<basic name="rolle">
				<column name="ROLLE" />
			</basic>
		</attributes>
	</entity>

</entity-mappings>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE jboss PUBLIC
	"-//JBoss//DTD JBOSS 4.2//EN"
	"http://www.jboss.org/j2ee/dtd/jboss_4_2.dtd">

<jboss>
	<security-domain>knaufsecurity</security-domain>
</jboss>