EJB 3.0 Preview - Security

Question

I was trying to use standard JDK annotations for securing EJB methods.
At the time of compiling my EJB using weblogic.appc, I am getting the following error.Please let me know if anybody has a solution to this.
Error processing annotations: java.lang.NullPointerException
The complete stack trace is:
java.lang.NullPointerException
[java] at weblogic.ejb.container.dd.xml.EjbAnnotationProcessor.processMethodPermissions(EjbAnnotationProcessor.java:968)
[java] at weblogic.ejb.container.dd.xml.EjbAnnotationProcessor.processAssemblyDescriptor(EjbAnnotationProcessor.java:631)
[java] at weblogic.ejb.container.dd.xml.EjbAnnotationProcessor.processSessionAnnotations(EjbAnnotationProcessor.java:579)
[java] at weblogic.ejb.container.dd.xml.EjbAnnotationProcessor.processAnnotations(EjbAnnotationProcessor.java:239)
[java] at weblogic.ejb.container.dd.xml.EjbAnnotationProcessor.processAnnotations(EjbAnnotationProcessor.java:143)
[java] at weblogic.ejb.container.dd.xml.EjbDescriptorReaderImpl.processStandardAnnotations(EjbDescriptorReaderImpl.java:215)
[java] at weblogic.ejb.container.dd.xml.EjbDescriptorReaderImpl.createReadOnlyDescriptorFromJarFile(EjbDescriptorReaderImpl.java:175)
[java] at weblogic.ejb.spi.EjbDescriptorFactory.createReadOnlyDescriptorFromJarFile(EjbDescriptorFactory.java:93)
[java] at weblogic.ejb.container.ejbc.EJBCompiler.parseDescriptors(EJBCompiler.java:1370)
[java] at weblogic.ejb.container.ejbc.EJBCompiler.compileEJB(EJBCompiler.java:434)
[java] at weblogic.application.compiler.AppcUtils.compileEJB(AppcUtils.java:297)
[java] at weblogic.application.compiler.EJBCompiler.compile(EJBCompiler.java:95)
[java] at weblogic.application.compiler.flow.AppCompilerFlow.compileInput(AppCompilerFlow.java:118)
[java] at weblogic.application.compiler.flow.AppCompilerFlow.compile(AppCompilerFlow.java:43)
[java] at weblogic.application.compiler.FlowDriver$FlowStateChange.next(FlowDriver.java:69)
[java] at weblogic.application.utils.StateMachineDriver.nextState(StateMachineDriver.java:26)
[java] at weblogic.application.compiler.FlowDriver.nextState(FlowDriver.java:36)
[java] at weblogic.application.compiler.FlowDriver.run(FlowDriver.java:26)
[java] at weblogic.application.compiler.Appc.runBody(Appc.java:163)
[java] at weblogic.utils.compiler.Tool.run(Tool.java:158)
[java] at weblogic.utils.compiler.Tool.run(Tool.java:115)
[java] at weblogic.application.compiler.Appc.main(Appc.java:174)
[java] at weblogic.appc.main(appc.java:14)
[java] <Aug 18, 2006 3:28:57 PM MDT> <Error> <J2EE> <BEA-160187> <weblogic.appc failed to compile your application. Recompile with the -verbose option for more details. Please see the error message(s) below.>
[java] Error processing annotations: java.lang.NullPointerException
I have given the source code of the ejb below.
Business Interface:
package examples
import java.util.Collection;
public interface Database {
     public Employee getEmployee(int empNo);
     public Collection<Employee> getEmployees();
     public Address getAddress(int empNo);
     public void createEmployee(Employee emp);
     public void updateEmployee(Employee emp);
     public void deleteEmployee(int empNo);
Bean Class: I removed the code inside the method not to be cluttery.I assumed this class causes two logical security roles created "Admin" and "User"
which needs to be mapped to the physical roles in weblogic-ejb-jar.xml.
The weblogic-ejb-jar.xml is also given below.I do not have any entry in ejb-jar.xml corresponding to this bean.
package examples
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.Collection;
import java.util.Vector;
import javax.annotation.Resource;
import javax.annotation.security.DeclareRoles;
import javax.annotation.security.DenyAll;
import javax.annotation.security.PermitAll;
import javax.annotation.security.RolesAllowed;
import javax.annotation.security.RunAs;
import javax.ejb.Remote;
import javax.ejb.SessionContext;
import javax.ejb.Stateless;
import javax.sql.DataSource;
@Stateless
@Remote(Database.class)
@DeclareRoles({"Admin","User"})
@RunAs("Admin")
public class DatabaseBean implements Database{
     @PermitAll
     public Employee getEmployee(int empNo) {
          return null;
     @RolesAllowed("Admin")
     public Collection<Employee> getEmployees(){
          return null;
     @PermitAll
     public Address getAddress(int empNo){
          return null;
     @RolesAllowed("Admin")
     public void createEmployee(Employee emp){
          return null;
     @PermitAll
     public void updateEmployee(Employee emp){
     @DenyAll
     public void deleteEmployee(int empNo){
weblogic-ejb-jar.xml:
<?xml version="1.0" encoding="UTF-8" ?>
<weblogic-ejb-jar xmlns="http://www.bea.com/ns/weblogic/90" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.bea.com/ns/weblogic/90 http://www.bea.com/ns/weblogic/90/weblogic-ejb-jar.xsd">
     <weblogic-enterprise-bean>     
          <ejb-name>DatabaseBean</ejb-name>
          <security-role-assignment>     
               <role-name>Admin</role-name>     
               <principal-name>AdminRole</principal-name>
          </security-role-assignment>
          <security-role-assignment>     
               <role-name>User</role-name>     
               <principal-name>UserRole</principal-name>
          </security-role-assignment>
     </weblogic-enterprise-bean>
</weblogic-ejb-jar>

Answer 1

I'm a little bit confused about the different
versions:
OC4J (OAS) 10.0.2 ==> J2EE 1.3: releaded.
Yes, correct.
OC4J 10.1.3 ==> J2EE 1.4: release date
maybe summer 2005?
Correct. But it will contain an usable, supportable implementation of the EJB 3.0 specification. So it's basically J2EE 1.4 + EJB 3.0.
By default it won't run with EJB 3.0 enabled.
You will need to specifically enable EJB 3.0 when you start the container.
Oc4J with EJB 3.0 features ==>> J2EE 1.5 ??, planned
release date?
There's no such beast planned yet.
Since we're actively working on an EJB 3.0 implementation, we thought we'd release it for you all to try out. It's based off the 10.1.3 code base. Since the timing was a bit out, we just put it out as a separate distro for the time being.
Our next 10.1.3 Developer Preview will reconcile this, and will be both OC4J 10.1.3 + EJB 3.0 in one package.
Hope that helps and not hinders your understanding!
cheers
-steve-