In the JOnAS distribution, there is an example named earsample, showing how to use the security. This chapter describes in more details this example, in order to illustrate how the security capabilities of JOnAS should be used. The example is a Session Bean whose methods are protected. The user calling this bean must be authorized to access these methods.
Since there is at the present time no authentification in JOnAS, we rely on Tomcat to make the identification and authentification steps.
This example shows how to access an EJB whose methods are protected.
The user must be identified and authenticated. We rely on Tomcat to do these steps.
Once done, the user has access to a servlet in Tomcat. This servlet calls some methods of the EJB with a security context in which the identity of the user approved by Tomcat is kept (this identity is called a principal).
The security service of JOnAS checks if the principal of the user is authorized to access the called method of the EJB.
If the access is allowed, the method is normally executed, otherwise an exception is sent back to the servlet which informs the user.