This page shows the correct usage of the security related annotations:
- javax.annotation.security.RolesAllowed
- javax.annotation.security.PermitAll
- javax.annotation.security.DenyAll
- javax.annotation.security.RunAs
- javax.annotation.security.DeclareRoles
Basic idea
- By default all methods of a business interface are accessible, logged in or not
- The annotations go on the bean class, not the business interface
- Security annotations can be applied to entire class and/or individual methods
- The names of any security roles used must be declared via
...
- @DeclareRoles
No restrictions
Allow anyone logged in or not to invoke 'svnCheckout'.
These three examples are all equivalent.
Code Block |
---|
@Stateless
public class OpenSourceProjectBean implements Project {
public String svnCheckout(String s) {
return s;
}
}
|
Code Block |
---|
@Stateless
@PermitAll
public class OpenSourceProjectBean implements Project {
public String svnCheckout(String s) {
return s;
}
}
|
Code Block |
---|
@Stateless
public class OpenSourceProjectBean implements Project {
@PermitAll
public String svnCheckout(String s) {
return s;
}
}
|
- Allow anyone logged in or not to invoke 'svnCheckout'.
Restricting a Method
Restrict the 'svnCommit' method to only individuals logged in and part of the "committer" role. Note that more than one role can be listed.
Code Block |
---|
@Stateless
@DeclareRoles({"committer"})
public class OpenSourceProjectBean implements Project {
@RolesAllowed({"committer"})
public String svnCommit(String s) {
return s;
}
public String svnCheckout(String s) {
return s;
}
}
|
...
- Allow only logged in users in the "committer" role to invoke 'svnCommit'.
- Allow anyone logged in or not to invoke 'svnCheckout'.
DeclareRoles
You need to update the @DeclaredRoles @DeclareRoles when referencing more roles in your annotationsroles via isCallerInRole(roleName).
Code Block |
---|
@Stateless @DeclareRoles({"committer", "contributor"}) public class OpenSourceProjectBean implements Project { @Resource SessionContext ctx; @RolesAllowed({"committer"}) public String svnCommit(String s) { ctx.isCallerInRole("committer"); // Referencing a Role return s; } @RolesAllowed({"contributor"}) public String submitPatch(String s) { return s; } } |
Restricting all methods in a class
Allow only logged in users in the "committer" role to invoke 'svnCommit', 'svnCheckout' and 'submitPatch'.Placing the annotation at the class level changes the default of PermitAll
Code Block |
---|
@Stateless @DeclareRoles({"committer"}) @RolesAllowed({"committer"}) public class OpenSourceProjectBean implements Project { public String svnCommit(String s) { return s; } public String svnCheckout(String s) { return s; } public String submitPatch(String s) { return s; } } |
Mixing class and method level restrictions
- Allow only logged in users in the "committer" role to invoke 'svnCommit', 'svnCheckout'
...
- or 'submitPatch'.
Mixing class and method level restrictions
Security annotations can be used at the class level and method level at the same time. These rules do not stack, so marking this method 'submitPatch' overrides the default of "committers".
Code Block |
---|
@Stateless @DeclareRoles({"committer", "contributor"}) @RolesAllowed({"committer"}) public class OpenSourceProjectBean implements Project { public String svnCommit(String s) { return s; } public String svnCheckout(String s) { return s; } @RolesAllowed({"contributor"}) public String submitPatch(String s) { return s; } } |
...
- Allow only logged in users in the "committer" role to invoke 'svnCommit' or 'svnCheckout'
...
- Allow only logged in users in the "contributor" role to invoke 'submitPatch'.
PermitAll
When annotating a bean class with @RolesAllowed, the @PermitAll annotation becomes very useful on individual methods to open them back up againAllow anyone logged in or not to invoke 'svnCheckout'.
Code Block |
---|
@Stateless @DeclareRoles({"committer", "contributor"}) @RolesAllowed({"committer"}) public class OpenSourceProjectBean implements Project { public String svnCommit(String s) { return s; } @PermitAll public String svnCheckout(String s) { return s; } @RolesAllowed({"contributor"}) public String submitPatch(String s) { return s; } } |
Example
...
title | Business Interface |
---|
...
- Allow only logged in users in the "committer" role to invoke 'svnCommit'.
- Allow only logged in users in the "contributor" role to invoke 'submitPatch'.
- Allow anyone logged in or not to invoke 'svnCheckout'.
DenyAll
The @DenyAll annotation can be used to restrict business interface access from anyone, logged in or not. The method is still invokable from within the bean class itself.
...
Code Block |
---|
@Stateless @DeclareRoles({"committer", "contributor","community}) @RolesAllowed({"committer"}) public class FooBeanOpenSourceProjectBean implements Project { @Resource private SessionContext context; @RolesAllowed({"committer"}) public String svnCommit(String s) { return s; } @RolesAllowed({"committer", "contributor"})@PermitAll public String submitPatchsvnCheckout(String s) { return s; } @PermitAll@RolesAllowed({"contributor"}) public String svnCheckoutsubmitPatch(String s) { return s; } @DenyAll public String deleteProject(String s) { return s; } public boolean isCallerInRole(String role){ return context.isCallerInRole(role); } } |
Code Block |
}
|
- Allow only logged in users in the "committer" role to invoke 'svnCommit'.
- Allow only logged in users in the "contributor" role to invoke 'submitPatch'.
- Allow anyone logged in or not to invoke 'svnCheckout'.
- Allow no one logged in or not to invoke 'deleteProject'.
Illegal Usage
Generally, security restrictions cannot be made on AroundInvoke methods and most callbacks.
The following usages of @RolesAllowed have no effect.
Code Block |
---|
@Stateful @DecalredRoles({"committer @Stateless @RunAs("contributor") @DeclareRoles({"committer", "contributor","community"}) public class BarBeanMyStatefulBean implements MyBusinessInterface Project { @Resource@PostConstruct private SessionContext context; @RolesAllowed({"committer"}) public Stringvoid svnCommitconstructed(String s) { return s;} } @PreDestroy @RolesAllowed({"committer", "contributor"}) public Stringvoid submitPatchdestroy(String s) { } return s;@AroundInvoke } @PermitAll@RolesAllowed({"committer"}) public StringObject svnCheckoutinvoke(StringInvocationContext sinvocationContext) throws Exception { return sinvocationContext.proceed(); } @DenyAll@PostActivate public String deleteProject(String s) {@RolesAllowed({"committer"}) public return s;void activated(){ } @PermitAll@PrePassivate public boolean isCallerInRole(String role){@RolesAllowed({"committer"}) public return context.isCallerInRole(role);void passivate(){ } } |