RDBMSRealm problem

Question

Hi Everyone,
I am implementing an EJB application with Weblogic5.1, RDBMSRealm security realm. My application requires user and group select/delect/update dynamically for "users" and "groupmembers" tables in the database. It is my understanding that I can implement it by creating a custom realm based on Weblogic RDBMSRealm example. My question is
when I try to connect the "users" and "groupmembers" tables, I have to do it through EJB entity bean as normal entity bean---table match in the EJB application, or it is not allowed to implement it through EJB entity bean, or either way above is ok?
Thanks a lot.
-John

Answer 1

John Wang wrote:
>
My question is when I try to connect the "users" and "groupmembers" tables, I have to do it through EJB
entity bean as normal entity bean---table match in the EJB application, or it is not allowed to implement
it through EJB entity bean, or either way above is ok?The container is going to use your security realm in order to enforce
security on EJB method calls (among other things) and using EJB to
implement its own security would be a bit circular. (This is also a
reason you have to use a connection pool separate from the one used by
the rest of the application). I haven't tried this but it may be
possible to have two different ejb-name entries (and two different JNDI
names) for the same User bean in the XML deployment descriptor(s) where
one of the beans would not have any method level security. Perhaps in
the latter case the container would not call the realm and you would be
able to use the same bean with different security. Security would be
compromised in this case if you let clients other than the server access
your unsecured bean.
Alexander Petrushko
mailto:[email protected]
Consulting Services available