Chapter 7 Security

303

EJB Container

Web Container

Client

Container

Enterprise

Bean

Web Service

Enterprise

Endpoint

Authentication

Bean

Authentication

Servlet/JSP

Context

Protection

Enterprise

Domain

Bean

Figure 7.3

Using the Web Container to Establish an EJB Tier Protection Domain

Another use case scenario involves sending a SOAP request to an EJB service

endpoint. Since the caller is making the SOAP request over HTTP, the Web

service authentication model handles authentication using similar mechanisms 

basic authentication and mutual SSL to the Web tier component use case. How 

ever, rather than use a Web component in front of the EJB component, the EJB

container directly handles the authentication. Note that in the J2EE platform, both

Web and EJB tier endpoints support the same mechanisms for Web service

authenication.

A third use case entails calls made directly to an enterprise bean using RMI 

IIOP. This scenario is not common for Web services since they are not accessed with

RMI IIOP. However, some Web service endpoints, while processing a request, may

need to access a remote enterprise bean component using RMI IIOP. The Common

Secure Interoperability (CSIv2) specification, which is an Object Management

Group (OMG) standard supported by the J2EE platform, defines a protocol for

secure RMI IIOP invocations. Using the CSIv2 defined Security Attribute Service,

client authentication is enforced just above the transport layer. The Security

Attribute Service also permits identity assertion, which is an impersonation mecha 

nism, so that an intermediate component can use an identity other than its own.

7.2.1.4

Enterprise Information System Tier Authentication

Many application components and Web service endpoints need to access enterprise

information systems, such as databases or JMS resources. J2EE components get

access to the connections of these resources through a resource manager connection