问JAAS - Java EE 6中的Java编程安全性(没有@DeclareRoles)

EN

@Singleton
@LocalBean
public class MySecurityDataManager {

    public void declareRole(String roleName) {
        ...
    }

    public void removeRole(String roleName) {
        ...
    }

    /**
     * Here, I do not know what your incoming user data looks like such as:
     * do they have groups, attributes? In my case I could determine user's groups
     * and then assign them to roles based on those. You may have some sort of
     * other attribute or just plain username to security role association.
     */
    public void associate(Object userAttribute, String roleName) {
        ...
    }

    public void disassociate(Object userAttribute, String roleName) {
        ...
    }

    /**
     * Here basically you inspect whatever persistence method you chose and examine
     * your existing associations to build a set of assigned security roles for a
     * user based on the given attribute(s).
     */
    public Set<String> determineSecurityRoles(Object userAttribute) {
        ...
    }
}

public class MyLoginModule implements LoginModule {

    private MySecurityDataManager srm;

    @Override
    public void initialize(Subject subject, CallbackHandler callbackHandler,
            Map<String, ?> sharedState, Map<String, ?> options) {
        // make sure to save subject, callbackHandler, etc.
        try {
            InitialContext ctx = new InitialContext();
            this.srm = (MySecurityDataManager) ctx.lookup("java:global/${your specific module names go here}/MySecurityDataManager");
        } catch (NamingException e) {
            // error logic
        }
    }

    @Override
    public boolean login() throws LoginException {
        // authenticate your user, see links above
    }

    @Override
    public boolean commit() throws LoginException {
        // here is where user roles get assigned to the subject
        Object userAttribute = yourLogicMethod();
        Set<String> roles = srm.determineSecurityRoles(userAttribute);
        // implement this, it's easy, just make sure to include proper equals() and hashCode(), or just use the Jboss provided implementation.
        Group rolesGroup = new SimpleGroup("Roles", roles);
        // assuming you saved the subject
        this.subject.getPrincipals().add(rolesGroup);
    }

    @Override
    public boolean abort() throws LoginException {
        // see links above
    }

    @Override
    public boolean logout() throws LoginException {
        // see links above
    }

}

<security-domain name="mydomain" cache-type="default">
    <authentication>
        <login-module flag="required"
                      code="my.package.MyLoginModule"
                      module="deployment.${your deployment specific info goes here}">
            <module-option name="my.package.MySecurityDataManager"
                           value="java:global/${your deployment specific info goes here}/MySecurityDataManager"/>
        </login-module>
    </authentication>
</security-domain>

1. There is more than one way to do this. For identifying the user, you only need to provide user's id in your http request, `JAAS` security is overkill. For example, provide userid by `URI:/user/bob`, or by URI parameters like: `/user?id=bob`. 
2. If security is mandatory (if I don't get it wrong, you are using javaee's standard security component), you'll need to deal with roles, because `java6`'s specification have role-based authentication/authorization written in.