Java EE中的访问控制

基本上，ACL是通过在会话Bean类或其程序安全性方法上使用@DeclareRoles和@RolesAllowed批注在Java EE中实现的。您还可以在部署描述符（web.xml）中使用元素，以描述您的角色和授权性，以实现无屑安全性。

这是Java EE教程中有关编程安全性的示例

package converter.ejb;

    import java.math.BigDecimal;
    import javax.ejb.Stateless;
    import java.security.Principal;
    import javax.annotation.Resource;
    import javax.ejb.SessionContext;
    import javax.annotation.security.DeclareRoles;
    import javax.annotation.security.RolesAllowed;

        @Stateless()
        @DeclareRoles("TutorialUser")
        public class ConverterBean{ 

               @Resource SessionContext ctx;
                private BigDecimal yenRate = new BigDecimal("89.5094");
                private BigDecimal euroRate = new BigDecimal("0.0081");

                @RolesAllowed("TutorialUser")
                 public BigDecimal dollarToYen(BigDecimal dollars) {
                    BigDecimal result = new BigDecimal("0.0");
                    Principal callerPrincipal = ctx.getCallerPrincipal();
                    if (ctx.isCallerInRole("TutorialUser")) {
                        result = dollars.multiply(yenRate);
                        return result.setScale(2, BigDecimal.ROUND_UP);
                    } else {
                        return result.setScale(2, BigDecimal.ROUND_UP);
                    }
                }

                @RolesAllowed("TutorialUser")
                public BigDecimal yenToEuro(BigDecimal yen) {
                    BigDecimal result = new BigDecimal("0.0");
                    Principal callerPrincipal = ctx.getCallerPrincipal();
                    if (ctx.isCallerInRole("TutorialUser")) {
                         result = yen.multiply(euroRate);
                         return result.setScale(2, BigDecimal.ROUND_UP);
                    } else {
                         return result.setScale(2, BigDecimal.ROUND_UP);
                    }
                }
            }

您还可以通过使用HttpServletRequest的登录，注销和身份验证方法进行身份验证，然后将getUserPrincipal和isUserInRole用于ACL来在servlet中进行操作。然后，您需要在web.xml中添加到servlet的描述中，以引用在web.xml中的元素中声明的角色。这是来自Java EE的ACL部分示例。

package enterprise.programmatic_login;

import java.io.*;
import java.net.*;
import javax.annotation.security.DeclareRoles;
import javax.servlet.*;
import javax.servlet.http.*;

@DeclareRoles("javaee6user")
public class LoginServlet extends HttpServlet {

    /** 
     * Processes requests for both HTTP GET and POST methods.
     * @param request servlet request
     * @param response servlet response
     */
    protected void processRequest(HttpServletRequest request, 
                 HttpServletResponse response)
            throws ServletException, IOException {
        response.setContentType("text/html;charset=UTF-8");
        PrintWriter out = response.getWriter();
        try {
            String userName = request.getParameter("txtUserName");
            String password = request.getParameter("txtPassword");

            out.println("Before Login" + "<br><br>");
            out.println("IsUserInRole?.." 
                        + request.isUserInRole("javaee6user")+"<br>");
            out.println("getRemoteUser?.." + request.getRemoteUser()+"<br>");
            out.println("getUserPrincipal?.." 
                        + request.getUserPrincipal()+"<br>");
            out.println("getAuthType?.." + request.getAuthType()+"<br><br>");

            try {
                request.login(userName, password); 
            } catch(ServletException ex) {
                out.println("Login Failed with a ServletException.." 
                    + ex.getMessage());
                return;
            }
            out.println("After Login..."+"<br><br>");
            out.println("IsUserInRole?.." 
                        + request.isUserInRole("javaee6user")+"<br>");
            out.println("getRemoteUser?.." + request.getRemoteUser()+"<br>");
            out.println("getUserPrincipal?.." 
                        + request.getUserPrincipal()+"<br>");
            out.println("getAuthType?.." + request.getAuthType()+"<br><br>");

            request.logout();
            out.println("After Logout..."+"<br><br>");
            out.println("IsUserInRole?.." 
                        + request.isUserInRole("javaee6user")+"<br>");
            out.println("getRemoteUser?.." + request.getRemoteUser()+"<br>");
            out.println("getUserPrincipal?.."
                        + request.getUserPrincipal()+"<br>");
            out.println("getAuthType?.." + request.getAuthType()+"<br>");
        } finally {
            out.close();
        }
    }

}

有关更完整的示例和说明，请参见Java EE教程提供的链接。