Security guide jboss

JBoss AS 6.0 Security Guide

Security with JBoss
Application Server 6 by Anil Saldhana, Marcus Moyses, and Stefan Guilhen

I. Security Overview .......................................................................................................... 1
1. J2EE Declarative Security Overview .................................................................... 3
1.1. Security References .................................................................................... 3
1.2. Security Identity .......................................................................................... 5
1.3. Security roles ............................................................................................. 7
1.4. EJB method permissions ............................................................................. 8
1.5. Web Content Security Constraints .............................................................. 13
1.6. Enabling Declarative Security in JBoss ....................................................... 16
2. Introduction to JAAS ......................................................................................... 19
2.1. The JAAS Core Classes ........................................................................... 19
2.1.1. The Subject and Principal Classes .................................................. 19
2.1.2. Authentication of a Subject ............................................................. 20
3. JBoss Security Model ........................................................................................ 25
3.1. Enabling Declarative Security in JBoss Revisited ........................................ 29
4. The JBoss Security Extension Architecture ...................................................... 35
4.1. How the JaasSecurityManager Uses JAAS ................................................. 36
4.2. The JaasSecurityManagerService MBean ................................................... 39
4.2.1. The