Enterprise bean security
Enterprise beans allow us to declaratively decide which users can access their methods. For example, some methods might only be available to users in certain roles. A typical scenario is that only users with the role of administrator can add, delete, or modify other users in the system.
The following example is a slightly modified version of the DAO session bean we saw earlier in this chapter. In this version, some methods that were previously private have been made public. Additionally, the session bean has been modified to allow only users in certain roles to access its methods:
package com.ensode.jakartaeebook;
//imports omitted for brevity
@Stateless
@RolesAllowed("admin")
public class SecureCustomerDaoBean {
@PersistenceContext
private EntityManager entityManager;
public Long saveCustomer(Customer customer) {
if (customer.getCustomerId() == null) {
...