Security, Transaction services and lifecycle are service of EJB or Container. What is of EJB and what is of Container ?
I would almost say that all of these are "of" the container.
- Security is enforced (declarative) and enabled (for programmatic security) by the container, which implements the necessary interfaces and contracts defined in the EJB specification.
- Transaction services are implemented by the container, although part of the actual transaction management might be incorporated into the supporting EJB classes generated by the container.
- Lifecycle management is also handled by the container as the EJBs live and die under the strict control of the container.
Hope this helps.