J2EE Application Security

Question

Does anyone know how to implement and propogate security interoperability between the web and ejb tiers. I have a single web application that is split by multiple GWT entry points - each an application within a single war. A user can log into 1..n GWT entry points. Each entry point or GWT module contains differnt roles for a single user. The differing app roles have common permissions.
For example, user1 is a user of app1 and app2.
app1 the user is a system administrator in role1 containing all CRUD operations or permissions
app2 the user is a user who has only read privs in role2 containing R operations or permission
The application share the ejb tier via business delegates. So, if the user accesses a service method that is simple fast read method returning a list of records in app1 the user will see all records based on isUserInRole, and in app2 the user should see a limited set of records based on isUserInRole. How can I propogate the users permissions based on the application to the ejb tier?

Answer 1

Hi,
JAAS is principal based and has no notion of groups. You can use groups in J2EE security, but these need to be defined in teh deployment desccriptor and then mapped to physical security groups that may be in OID.
Frank