The XML metadata configuration is almost exactly like in the ejb-jar.xml deployment descriptor of J2EE. The exception is that we've added the ability to define security for constructor and field access of a Java class. To use AOP security, all you have to do is define security class-metadata. The needed interceptors are automatically bound to the class via a annotation binding. Below is an explanation of the security metadata you need to define.
<aop> ... <annotation tag="security" class="org.jboss.test.SecuredPOJO"> <security-domain>java:/jaas/other</security-domain> <run-as>admin</run-as>The security-domain defines the JBoss security domain to use. See JBoss J2EE documentation on what this means. The run-as tag works in the same way as the EJB run-as tag.
<method-permission>
<role-name>allowed</role-name>
<method>
<method-name>someMethod</method-name>
</method>
</method-permission>
<method-permission>
<unchecked/>
<method>
<method-name>unchecked</method-name>
</method>
</method-permission>
Method permissions are defined in the same exact way as in EJB land.
<field-permission>
<role-name>allowed</role-name>
<field>
<field-name>someField</field-name>
</field>
</field-permission>
<field-permission>
<unchecked/>
<field>
<field-name>uncheckedField</field-name>
</field>
</field-permission>
Field permissions can be defined as well and are very similar to the defintion of method permissions.
<constructor-permission>
<unchecked/>
<constructor>
<constructor-params/>
</constructor>
</constructor-permission>
You can define permissions on constructors as well. An empty constructor-params corresponds to the default constructor.
<constructor-permission>
<role-name>allowed</role-name>
<constructor>
<constructor-params>
<constructor-param>int</constructor-param>
</constructor-params>
</constructor>
</constructor-permission>
The above shows how to define a permission on a constructor with a particular argument list.
<exclude-list>
<description>Methods that connect be used</description>
<method>
<method-name>excluded</method-name>
</method>
<field>
<field-name>excludedField</field-name>
</field>
<constructor>
<constructor-params>
<constructor-param>java.lang.String</constructor-param>
</constructor-params>
</constructor>
</exclude-list>
As in EJB land, you can define exclude lists for fields and constructors as well as methods.
</class-metadata> </aop>