type=page
status=published
title=Securing Containers
next=security-intro004.html
prev=security-intro002.html
~~~~~~
= Securing Containers

[[BNBXE]]

[[securing-containers]]
Securing Containers
-------------------

In Java EE, the component containers are responsible for providing
application security. A container provides two types of security:
declarative and programmatic.

The following topics are addressed here:

* link:#BNBXG[Using Annotations to Specify Security Information]
* link:#BNBXF[Using Deployment Descriptors for Declarative Security]
* link:#BNBXH[Using Programmatic Security]

[[BNBXG]]

[[using-annotations-to-specify-security-information]]
Using Annotations to Specify Security Information
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Annotations enable a declarative style of programming and so encompass
both the declarative and programmatic security concepts. Users can
specify information about security within a class file by using
annotations. GlassFish Server uses this information when the application
is deployed. Not all security information can be specified by using
annotations, however. Some information must be specified in the
application deployment descriptors.

Specific annotations that can be used to specify security information
within an enterprise bean class file are described in
link:security-javaee002.html#GJGDI[Securing an Enterprise Bean Using
Declarative Security]. link:security-webtier.html#BNCAS[Chapter 51,
"Getting Started Securing Web Applications"], describes how to use
annotations to secure web applications where possible. Deployment
descriptors are described only where necessary.

For more information on annotations, see
link:security-intro007.html#BNBYJ[Further Information about Security].

[[BNBXF]]

[[using-deployment-descriptors-for-declarative-security]]
Using Deployment Descriptors for Declarative Security
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Declarative security can express an application component's security
requirements by using deployment descriptors. Because deployment
descriptor information is declarative, it can be changed without the
need to modify the source code. At runtime, the Java EE server reads the
deployment descriptor and acts upon the corresponding application,
module, or component accordingly. Deployment descriptors must provide
certain structural information for each component if this information
has not been provided in annotations or is not to be defaulted.

This part of the tutorial does not document how to create deployment
descriptors; it describes only the elements of the deployment descriptor
relevant to security. NetBeans IDE provides tools for creating and
modifying deployment descriptors.

Different types of components use different formats, or schemas, for
their deployment descriptors. The security elements of deployment
descriptors discussed in this tutorial include the following.

* Web components may use a web application deployment descriptor named
`web.xml`.
+
The schema for web component deployment descriptors is provided in
Chapter 14 of the Java Servlet 4.0 specification (JSR 369), which can be
downloaded from `http://jcp.org/en/jsr/detail?id=369`.
* Enterprise JavaBeans components may use an EJB deployment descriptor
named `META-INF/ejb-jar.xml`, contained in the EJB JAR file.
+
The schema for enterprise bean deployment descriptors is provided in
Chapter 14 of the EJB 3.2 Core Contracts and Requirements Specification
(JSR 345), which can be downloaded from
`http://jcp.org/en/jsr/detail?id=345`.

[[BNBXH]]

[[using-programmatic-security]]
Using Programmatic Security
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Programmatic security is embedded in an application and is used to make
security decisions. Programmatic security is useful when declarative
security alone is not sufficient to express the security model of an
application. The API for programmatic security consists of methods of the Java
EE Security API `SecurityContext` interface, and methods of the EJB `EJBContext`
interface and the servlet `HttpServletRequest` interface. These
methods allow components to make business-logic decisions based on the
security role of the caller or remote user.

Programmatic security is discussed in more detail in the following
sections:

* link:security-webtier003.html#GJIIE[Using Programmatic Security with
Web Applications]
* link:security-javaee002.html#GJGCS[Securing an Enterprise Bean
Programmatically]
