298

J2EE Platform Security Model

Declarative references in the deployment descriptor, rather than program

code, define much of the security for a J2EE application. The collection of secu 

rity declarations forms the security policy for an application. When security is

defined declaratively, the container is responsible for performing security and the

application does not include code specifically for security operations. Since secu 

rity references are in the deployment descriptor, developers can modify the secu 

rity for an application by using tools or changing the deployment descriptor. At

deployment, the container uses the application security policy declared in the

deployment descriptor to set up the security environment for the J2EE application,

just as it uses other references in the deployment descriptor to perform similar ser 

vices for transactions, remote communication, and so forth. During runtime, the

container interposes itself between the client calls and the application's compo 

nents to perform security checks and otherwise manage the applications. 

In addition to declarative security, the J2EE platform includes APIs to add

security code into your components. 

Programmatic security

 refers to security

decisions that are made by security aware applications. Programmatic security,

which allows an application to include code that explicitly uses a security mecha 

nism, is useful when declarative security alone cannot sufficiently express the

security model of an application. The J2EE programming model offers some pro 

grammatic services that help you to write security functionality into the application

code.

As noted, rather than inventing new security mechanisms, the J2EE platform

facilitates the incorporation of existing security mechanisms into an application

server operational environment. That is, the J2EE security model integrates with

existing authorization and authentication mechanisms, handling existing user

identity information, digital certificates, and so forth. The model provides a unify 

ing layer above other security services, and its coherent programming model hides

the security implementation details from application developers. For example, the

J2EE security model provides mechanisms to leverage existing Internet security

standards such as Secure Sockets Layer (SSL).

In addition, the J2EE platform security model gives you the ability to provide

security boundaries. Once you have established these security boundaries, you can

map users to their organizational roles and combine users into logical groups

according to these roles.

Let's look in more detail at the J2EE platform security services and mecha 

nisms. This security model applies to Web services as well as to the entire J2EE

platform.  Security for Web Service Interactions  on page 308 describes how a

Web service application can leverage these J2EE security mechanisms.