Borland VisiBroker® 7.0 - Borland Technical Publications

ChapterChapter4AuthorizationAuthorization is the process of verifying that the user has the authority to perform therequested operations on the server. For example, when a client accesses an enterprisebean method the application server must verify that the user of the client has theauthority to perform such an access. Authorization occurs after authentication(confirming the user's identity).Authorization is based on the user's identity and an access control list (ACL), which is alist of who can access designated functions. Typically, an access control list specifies aset of roles that can use a particular resource. It also designates the set of peoplewhose attributes match those of particular roles, and who are then allowed to performactions in those roles.Borland uses an access control scheme based on roles. The deployment descriptormaintains a list of roles that are authorized to access each enterprise bean method.The Borland Security Service uses a role database (Role DB) to associate useridentities with EJB roles. If a user is associated with at least one allowed role, the usermay access the method.Defining access control with Role DBRole DB is a text file containing the roles and the access IDs associated with thoseroles. Each role in Role DB constitutes a role entry.In VisiBroker, the Role DB file is located with the Security Profiles in the BorlandDeployment Platform installation footprint:/var/security/profiles//The default Role DB, default.rolemap, is located in:/var/security/profiles/default/default.rolemapIn VisiBroker, the location of the rolemap file is specified through the propertyvbroker.security.domain..rolemap_pathChapter 4: Authorization 43