EJB security

Enterprise JavaBeans allow us to declaratively decide which users can access their methods. For example, some methods might only be available to users in certain roles. A typical scenario is that only users with the administrator role can add, delete, or modify other users in the system.

The following example is a slightly modified version of the DAO session bean we saw earlier in this chapter. In this version, some methods that were previously private are made public. Additionally, the session bean was modified to allow only users in certain roles to access its methods:

package net.ensode.javaeebook; 
 
// imports omitted 
 
@Stateless 
@RolesAllowed("appadmin") 
public class CustomerDaoBean implements CustomerDao 
{ 
  @PersistenceContext 
  private EntityManager entityManager; 
 
  @Resource(name = "jdbc/__CustomerDBPool") 
  private DataSource dataSource; 
 
  public void saveCustomer(Customer customer) 
  { 
    if (customer.getCustomerId() == null) 
    { 
      saveNewCustomer...