stateless session bean and declaritive security

[talu singh]

I am confused on how stateful and stateless bean behave under security context.

On Cades and Sheil's sample, Fig 9-3.

There is a @stateless BidManager class that has findBid, and createBid method.

If user needs to be authenticated before they can use these method, do we need to change this to stateful session bean? I think it is not necessary but I want to know the best practice. If user's information is also needed while creating bid, would it be better to change the bean to stateful session bean.

Normally, controller does the authentication, and the security context is propagated to the ejb classes right? And if declarative authorization is used, @DeclareRoles annotation can be used .

Thanks

[Ryan Fernandes]

I am confused on how stateful and stateless bean behave under security context.

They both behave the same.

If user needs to be authenticated before they can use these method, do we need to change this to stateful session bean

Nope.

If user's information is also needed while creating bid, would it be better to change the bean to stateful session bean.

Noope! Secure your bean (@RolesAllowed) and then use the getCallerPrincipal()/isCallerInRole() methods to get the userID/Roles and then retrieve whatever information you need about the user.

Normally, controller does the authentication, and the security context is propagated to the ejb classes right

Once you authenticate against the container (web/ejb) the security context is propogated to the ejb classes by the 'container'.

a word to the wise: reading more about the different types of EJBs (and their applicability when solving a business problem) will hold you in good stead.

[talu singh]

Thanks, for the great answer.

[talu singh]

If you are using JAAS DatabaseLoginModule for authentication, is it possible to let the container handle authorization?
or does JAAS has to handle both authentication and authorization?

Or does most JEE container handle declarative security using JAAS.

Thanks