EJB method security

Question

I know that it is possible to secure an EJB method by method using ejb-jar.xml or securing them all by specifying <method-name>*</method-name>. I was wondering though how you can easily open up just a few of those methods for use by an anonymous user. I have a large number of methods and was hoping I would only have to specify the ones that need not be secure, instead of securing all of the other ones, one by one.
Thanks in advance,
Ted

Answer 1

Hello,
It should be pretty simple to open up a few methods for use by an anonymous user.
In your ejb-jar.xml file add an anonymous user role and add that role to the methods you want to open up
<assembly-descriptor>
<security-role>
<role-name>manger</role-name>
</security-role>
<security-role>
<role-name>anonymous</role-name>
</security-role>
<method-permission>
<!-- open up this method -->
<role-name>manager</role-name>
<role-name>anonymous</role-name>
<method>
<ejb-name>accountsPayable</ejb-name>
<method-name>getReceipts</method-name>
</method>
</method-permission>
<assembly-descriptor>
Of course
Cheers,
Hoos
Message was edited by hoos at Feb 11, 2005 3:40 AM