Sun Microsystems Inc.

20.4 Deployer’s responsibilities

The Deployer is responsible for ensuring that an assembled application is secure after it has been deployed in the target operational environment. This section defines the Deployer’s responsibility with respect to EJB security management.

The Deployer uses deployment tools provided by the EJB Container Provider to read the security view of the application supplied by the Application Assembler in the deployment descriptor. The Deployer’s job is to map the security view that was specified by the Application Assembler to the mechanisms and policies used by the security domain in the target operational environment. The output of the Deployer’s work includes an application security policy descriptor that is specific to the operational environment. The format of this descriptor and the information stored in the descriptor are specific to the EJB Container.

The following subsections describe the security related tasks performed by the Deployer.

20.4.1 Security domain and principal realm assignment

The Deployer is responsible for assigning the security domain and principal realm to an enterprise bean application.

Multiple principal realms within the same security domain may exist, for example, to separate the realms of employees, trading partners, and customers. Multiple security domains may exist, for example, in application hosting scenarios.

20.4.2 Assignment of security roles

The Deployer assigns principals and/or groups of principals (such as individual users or user groups) used for managing security in the operational environment to the security roles defined in the secu- rity-role elements of the deployment descriptor.

Typically, the Deployer does not need to change the method permissions assigned to each security role in the deployment descriptor.

The Application Assembler linked all the security role references used in the bean’s code to the security roles defined in the security-role elements. The Deployer does not assign principals and/or principal groups to the security role references—the principals and/or principals groups assigned to a security role apply also to all the linked security role references. For example, the Deployer of the AardvarkPayroll enterprise bean in subsection 20.3.3 would assign principals and/or principal groups to the security-role payroll-department, and the assigned principals and/or principal groups would be implicitly assigned also to the linked security role payroll.

Sun Microsystems Inc

The EJB architecture does not specify how an enterprise should implement its security architecture. Therefore, the process of assigning the logical security roles defined in the application’s deployment descriptor to the operational environment’s security concepts is specific to that operational environment. Typically, the deployment process consists of assigning to each security role one or more user groups (or individual users) defined in the operational environment. This assignment is done on a per-application basis. (That is, if multiple independent ejb-jar files use the same security role name, each may be assigned differently.)

20.4.3 Principal delegation

The Deployer is responsible for configuring the principal delegation for inter-component calls. The Deployer must follow any instructions supplied by the Application Assembler (for example, provided in the runAs-specified-identity elements of the deployment descriptor, in the description elements of the deployment descriptor, or in a deployment manual).

If the use-caller-identity element is specified, the caller principal is propagated from one component to another (i.e. the caller principal of the first enterprise bean in a call-chain is passed to the enterprise beans down the chain). This ensures that the returned value of getCallerPrincipal() will be the same for all the enterprise beans involved in a call chain. Note that if the security infrastructure performs principal mapping in the course of the call chain, however, the getCallerPrincipal() method returns the principal that is the result of the mapping, not the original caller principal.

If the Application Assembler specifies that a runAs identity be used on behalf of a particular enterprise bean, the Deployer must configure the enterprise beans such that the runAs principal is used as the caller principal on any calls that the enterprise bean makes to other beans, and that the runAs principal is propagated along the call-chain of those other beans (in the absence of the specification of any further runAs-specified-identity elements).

20.4.4 Security management of resource access

The Deployer’s responsibilities with respect to securing resource managers access are defined in subsection 19.4.2.

20.4.5 General notes on deployment descriptor processing

The Deployer can use the security view defined in the deployment descriptor by the Bean Provider and Application Assembler merely as “hints” and may change the information whenever necessary to adapt the security policy to the operational environment.

Since providing the security information in the deployment descriptor is optional for the Application Assembler, the Deployer is responsible for performing any tasks that have not been done by the Application Assembler. (For example, if the definition of security roles and method permissions is missing in the deployment descriptor, the Deployer must define the security roles and method permissions for the application.) It is not required that the Deployer store the output of this activity in the standard ejb-jar file format.