Enterprise Java Security: Building Secure J2EE Applications

The J2EE platform has achieved remarkable success in meeting enterprise needs, resulting in its widespread adoption. The security infrastructure plays a key role in the...

An enterprise Java environment, or WAS environment, is nominally viewed as a three-tier architecture (see Section 2.on page 25). Clients access the information made available...

A J2EE application, an enterprise application that conforms to the J2EE specification, is structured as shown in Figure and consists of the following: Zero or more...

J2EE applications are required to use RMI-IIOP when accessing EJB components. This allows enterprise beans to be portable between container implementations. A J2EE container provides the...

A resource adapter is defined in the J2EE Connector Architecture specification as a system-level software driver that a Java application uses to connect to an...

is a standard Java messaging API that provides a common mechanism for Java-language programs to access messaging systems. Java clients and middle-tier components must be...

It would be helpful to understand a simple e-business request flow in an enterprise Java environment. Figure presents a simple request flow that does not...

J2EE defines roles that reflect the responsibilities within an organization. Any person or software involved in the process of making an application available within an...

The J2EE authorization model is based on the concept of security roles. Security roles are different from J2EE platform roles. As noted in Section 3.on...

Security policies associated with URIs and enterprise beans include the following: Login configurations associated with URIs: for example, use of form-based loginAuthorization policies associated with URIs...

Declarative security should always be used instead of programmatic security whenever possible. However, when declarative security is insufficient, it may be necessary to retrieve security-sensitive...

A fundamental aspect of any distributed computing system is remote communication. In an enterprise environment, components, such as Web servers, plug-ins, and WASs; external servers,...

We are now ready to revisit the simple e-business request flow presented in Section on page 63 with the security semantics added to the flow....