When not to use EJB?

[Siegfried Heintze]

In chapt 4 (page 176) of Allen's book there is a brief mention that EJBs can be overkill if the object can be accessed locally and one should use POJOs instead.
This is curious in light of Marc Fleury's comments at our recent User's Group meeting: Never use serialization and always put your EJBs on the same CPU as your web server (which is always practicle with JBoss since there are no licensing fees).
Well, assuming we are creating a web application and everything is on the same CPU and we don't want CMP Entity beans (I hear they are slow and don't support inheritance) when should we use EJB instead of POJOs (plain old java objects)? Do we need EJBs for role based security? Don't Apache HTTPD and Apache Tomcat implement authorization and authentication? I believe they do because I just used it!
I have not heard much encouragement about statefull session beans either.
I am tempted to conlude that EJBs are not terribly useful for Web applications and are mostly useful for 2 tier applications where there is no web server to provide authorization, authentication, no browser to support session state (with cookies and hidden fields).
Please critque my logic and assumptions here if you disagree!
Thanks,
Siegfried

[Darryl A. J. Staflund]

> ...we don't want CMP Entity beans (I hear they
> are slow and don't support inheritance)
You can subclass CMP entity beans by (i) creating a class A that implements EntityBean, (ii) creating an abstract class B that extends class B , (iii) coding your local and remote object and home interfaces so that they account for the methods in both classes, and (iv) designing your ejb-jar.xml file so that its CMP and CMR details reflect the appropriate methods in classes A and B.
This problem is not specific to CMP entity beans -- it's common to any sort of entity bean and session bean.

> when should we use EJB instead of POJOs (plain
> old java objects)?
You want to use EJBs if you want to take advantage of the transaction, security, etc. and other services provided by the EJB container.

> Do we need EJBs for role based security?
You don't need it but it speeds up the development process and cuts down on coding errors.

I think CMP beans perform quite well once you learn how to set up caching, optimistic locking, and other performance enhancing tweaks that may or may not be implemented by your EJB container.
Cheers,
Darryl

[bob dapaah]

The Wrox "Design and Development" book suggests using JDOs or DAOs rather than entity beans in most, if not all, circumstances.

[Siegfried Heintze]

Thanks for your response Darryl.
Do agree or disagree about Allen's and Bambara's comment that the only time not to use EJB is when your object is local?
Sieg