Instance Level Security (user level security) ?

Question

Hi, I would like to have instance level security in my ejbs. That is I want to verify that the person calling my CMP ejbs is the one who logged-in. I don't want the logged-in user accessing someone else's information. I would like to know what is the best way to implement this?
I was thinking along the line of having code in my cmp's ejbload method. The code would find the user owner of the record it belongs to by navigating to the owner using the cmr relationships. Let us say that there are three cmp beans: user, order and orderlineitem with the following relationships:
user has 1-to-n relationship with order. Order has 1-to-n relationship with orderlineitem. So, in my orderlineitem->ejbLoadmethod, I would try to find the user to it belongs to by navigating to user bean and finding the userlike this:
String userName = getOrder.getUser().getUserName();
if (userName.equals(ec.getCallerPrincipal().getName)) {
System.out.println("user is right");
} else {
System.out.println("user is NOT not the right user");
Is this a good idea? Is there a better way to do this?

Answer 1

When I go to application server controlHow you are accessing the ASC? Please also check your IE settings.
Additionally you can review
http://download.oracle.com/docs/cd/B25221_04/core.1013/b25209/tools.htm#i1055655
I do think that the error is related to role. You can also check the above link under heading (Creating Administrative Users and Assigning Administrative Roles).
Hope it is helpful.
Adith