Abstract: By using the container-based security mechanism of J2EE, the system security of J2EE can be managed by RBAC (Role-based Access Control) without code modification of J2EE components. RBAC was realized simply by the deployment descriptor configure of J2EE container. RBAC security strategy, executed to protect J2EE system resource based on the security truss of container, was picked up from deploy descriptor. Because the development of J2EE component separates from security, the developers of components can be absorbed in the businesses logic of components. Therefore, the cost of system development and maintenance will fall down, and the components become transplantable.

Key words: role-based access control, J2EE, declarative security strategy, deployment descriptor, configure

摘要： 利用J2EE基于容器的安全机制，将基于角色的访问控制（Role-Based Access Control，RBAC）融入J2EE安全之中，用RBAC来管理J2EE组件安全而不需修改各组件的代码。RBAC的实现只需通过容器部署描述符配置既可，系统运行时，容器从部署描述符中读取出相应的RBAC安全策略，然后根据安全策略执行安全验证，实现RBAC对系统资源的保护。这样，组件开发和系统安全相分离，开发人员可不关心系统安全，集中精力投入组件的业务逻辑开发，安全问题由组件组装人员、部署者和系统管理员来完成。因此，降低了对编程人员的要求和系统开发成本开发成本，也提高了系统组件的可移植性。

关键词: 基于角色的访问控制, J2EE, 申明性安全策略, 部署描述符, 配置