XML Configured Security

AOP Security brings J2EE/EJB like security to plain Java classes. Read up on EJB security to get a feel of what we are talking about here. You can apply security either through XML or via annotations.

The XML metadata configuration is almost exactly like in the ejb-jar.xml deployment descriptor of J2EE. The exception is that we've added the ability to define security for constructor and field access of a Java class. To use AOP security, all you have to do is define security class-metadata. The needed interceptors are automatically bound to the class via a annotation binding. Below is an explanation of the security metadata you need to define. 

<aop>
...
   <annotation tag="security" class="org.jboss.test.SecuredPOJO">
   <security-domain>java:/jaas/other</security-domain>
   <run-as>admin</run-as>
The security-domain defines the JBoss security domain to use. See JBoss J2EE documentation on what this means. The run-as tag works in the same way as the EJB run-as tag. 

   
   <method-permission>
      <role-name>allowed</role-name>
      <method>
         <method-name>someMethod</method-name>
      </method>
   </method-permission>
   <method-permission>
      <unchecked/>
      <method>
         <method-name>unchecked</method-name>
      </method>
   </method-permission>

Method permissions are defined in the same exact way as in EJB land. 

   <field-permission>
     <role-name>allowed</role-name>
     <field>
        <field-name>someField</field-name>
     </field>
   </field-permission>
   <field-permission>
     <unchecked/>
     <field>
        <field-name>uncheckedField</field-name>
     </field>
   </field-permission>
Field permissions can be defined as well and are very similar to the defintion of method permissions. 

  
   <constructor-permission>
      <unchecked/>
      <constructor>
        <constructor-params/>
      </constructor>
   </constructor-permission>
You can define permissions on constructors as well. An empty constructor-params corresponds to the default constructor. 
   <constructor-permission>
      <role-name>allowed</role-name>
      <constructor>
        <constructor-params>
           <constructor-param>int</constructor-param>
        </constructor-params>
      </constructor>
   </constructor-permission>
The above shows how to define a permission on a constructor with a particular argument list. 
   
   <exclude-list>
      <description>Methods that connect be used</description>
      <method>
         <method-name>excluded</method-name>
      </method>
      <field>
         <field-name>excludedField</field-name>
      </field>
      <constructor>
         <constructor-params>
            <constructor-param>java.lang.String</constructor-param>
         </constructor-params>
      </constructor>
   </exclude-list>
As in EJB land, you can define exclude lists for fields and constructors as well as methods. 
   
</class-metadata>
</aop>