ejb3.0學習--安全服務（Security service）

1.定義安全域（兩種方式）
 a:    define through jboss.xml ,the jboss.xml must put into META-INF in *.jar.
  <?xml version="1.0" encoding="UTF-8"?>
  <jboss>
   <!-- Bug in EJB3 of JBoss 4.0.4 GA
   <security-domain>java:/jaas/other</security-domain>
   -->
   <security-domain>other</security-domain>
   <unauthenticated-principal>AnonymousUser</unauthenticated-principal>
  </jboss>
 b:    define through annotate @SecurityDomain 
  import org.jboss.annotation.security.SecurityDomain;
  @Stateless
  @Remote ({SecurityAccess.class})
  @SecurityDomain("other")
  public class SecurityAccessBean implements SecurityAccess{
 2.定義用戶名，密碼及用戶的角色 （users.properties , roles.properties,類路徑下）
 3。爲業務方法定義訪問角色
 @Stateless
 @Remote ({SecurityAccess.class})
 public class SecurityAccessBean implements SecurityAccess{
  @RolesAllowed({"AdminUser"})
  public String AdminUserMethod() {
   return "only admin can access!";
  }
  @RolesAllowed({"DepartmentUser"})
  public String DepartmentUserMethod() {
   return "only DepartmentUser can access!";
  }
  @PermitAll
  public String AnonymousUserMethod() {
   return "all use can access1";
  }
 }

 test:
 String user = request.getParameter("user");
 String pwd = request.getParameter("pwd");
 if (user!=null && !"".equals(user.trim())){
  SecurityAssociation.setPrincipal(new SimplePrincipal(user.trim()));
  SecurityAssociation.setCredential(pwd.trim().toCharArray());
 }

 4.擴展安全定義到數據庫，安全域在/server/all/conf/login-config.xml中定義
 <application-policy name="foshanshop">
 <authentication>
  <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required">
  <module-option name="dsJndiName">java:/DefaultMySqlDS</module-option>
  <module-option name="principalsQuery">
   select password from sys_user where name=?
  </module-option>
  <module-option name="rolesQuery">
   select rolename,'Roles' from sys_userrole where username=?
  </module-option>
  <module-option name = "unauthenticatedIdentity">AnonymousUser</module-option>
  </login-module>
 </authentication>
 </application-policy>
 這裏使用了jboss數據庫登錄模塊：org.jboss.security.auth.spi.DatabaseServerLoginModule 在jbossx.jar中

 配置jboss.xml

 <?xml version="1.0" encoding="UTF-8"?>
 <jboss>
  <security-domain>youname</security-domain>
  <unauthenticated-principal>AnonymousUser</unauthenticated-principal>
 </jboss>