如何在weblogic 中对EJB 使用角色权限控制
在开发者角度来说，应用程序本身只需定义那些角色”role” 可访问哪些方法， 具体的角色与实际系统中用户的映射关系由deployer 来定义。
一. application.xml 定义需要用到的Role
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE application PUBLIC '-//Sun Microsystems, Inc.//DTD J2EE Application 1.3//EN' 'http://java.sun.com/dtd/application_1_3.dtd'>
<application>
<display-name>EjbTest</display-name>
<module>
<ejb>EjbTest.jar</ejb>
</module>
<security-role>
<description></description>
<role-name>MyRole1</role-name>
</security-role>
</application>
二. weblogic-application.xml 把系统用户(springview)映射到Role(MyRole1)
<!DOCTYPE weblogic-application PUBLIC '-//BEA Systems, Inc.//DTD WebLogic Application 8.1.0//EN' 'http://www.bea.com/servers/wls810/dtd/weblogic-application_2_0.dtd'>
<weblogic-application>
<security>
<security-role-assignment>
<role-name>MyRole1</role-name>
<principal-name> springview </principal-name>
</security-role-assignment>
</security>
<application-param>
<param-name>webapp.encoding.default</param-name>
<param-value>UTF-8</param-value>
</application-param>
<classloader-structure>
</classloader-structure>
</weblogic-application>
三. ejb-jar.xml 定义了那些方法可被那些角色访问
<ejb-jar>
<enterprise-beans>
<session>
<ejb-name>Ses</ejb-name>
<home>src.SesHome</home>
<remote>src.Ses</remote>
<ejb-class>src.SesBean</ejb-class>
<session-type>Stateless</session-type>
<transaction-type>Container</transaction-type>
<security-role-ref>
<!-- 定义了可在程序中使用的不变的MyRole映射名称 -->
<role-name>MyRole1</role-name>
<role-link>MyRole1</role-link>
</security-role-ref>
</session>
</enterprise-beans>
<assembly-descriptor>
<!-- 这一段必须要有，定义了在这个ejb 中要使用角色的logicname -->
<security-role>
<role-name>MyRole1</role-name>
</security-role>
<method-permission>
<!-- 定义了method2 只能由MyRole1 来访问，如果用户以springview名义通过jndi 来lookup 这个ejb 即具有MyRole1 角色 -->
<role-name>MyRole1</role-name>
<method>
<ejb-name>Ses</ejb-name>
<method-intf>Remote</method-intf>
<method-name>method2</method-name>
</method>
</method-permission>
<method-permission>
<role-name>MyRole1</role-name>
<method>
<ejb-name>Ses</ejb-name>
<method-intf>Remote</method-intf>
<method-name>method1</method-name>
</method>
</method-permission>
</assembly-descriptor>
</ejb-jar>
四. 建立用springview用户登陆 jndi 的InitialContext， 通过该InitialContext 进行lookup 操作的资源或对象（如:ejb） 都具有springview用户身份
private static Context getInitialContext() throws Exception {
String url = "t3://localhost:7001";
String user = " springview ";//"test";
String password = " springview1234";//"test";
Properties properties = null;
try {
properties = new Properties();
properties.put(Context.INITIAL_CONTEXT_FACTORY, "weblogic.jndi.WLInitialContextFactory");
properties.put(Context.PROVIDER_URL, url);
if (user != null) {
properties.put(Context.SECURITY_PRINCIPAL, user);
properties.put(Context.SECURITY_CREDENTIALS, password == null ? "" : password);
}
return new InitialContext(properties);
}
catch(Exception e) {
//log("Unable to connect to WebLogic server at " + url);
//log("Please make sure that the server is running.");
throw e;
//e.printStackTrace() ;
}
}