Chapter 7 Security

317

identity

 identity selection policy, both defined in the deployment descriptor. The

container then uses either the calling component's identity (if the policy is to use the

use caller identity

) or, for 

run as(role name)

, a static identity previously des 

ignated at deployment from the principal identities mapped to the named security

role.

Developers can define component identity selection policies for J2EE Web

and EJB resources, including Web service endpoints. If you want to hold callers

accountable for their actions, you should associate a 

use caller identity

 policy

with component callers. Using the 

run as(role name)

 identity selection policy

does not maintain the chain of traceability and may be used to afford the caller

with the privileges of the component. Code Example 7.6 shows how to configure

client identity selection policies in an enterprise bean deployment descriptor. 

...

 guest 

...

...

Code Example 7.6

Configuring Identity Selection Policies for Enterprise Beans

Code Example 7.7 shows how to configure client identity selection policies in

Web component deployment descriptors. If 

run as

 is not explicitly specified, the

use caller identity

 policy is assumed.