SRV.11.4 Roles

A role is an abstract logical grouping of users that is defined by the application developer or assembler. When the application is deployed, these roles are mapped by a deployer to security identities, such as principals or groups, in the runtime environment.

A servlet container enforces declarative or programmatic security for the principal associated with an incoming request based on the security attributes of that calling principal. For example,

1. When a deployer has mapped a security role to a user group in the operational environment, the user group to which the calling principal belongs is retrieved from its security attributes. If the principal's user group matches the user group in the operational environment that the security role has been mapped to, the principal is in the security role.

2. When a deployer has mapped a security role to a principal name in a security policy domain, the principal name of the calling principal is retrieved from its security attributes. If the principal is the same as the principal to which the security role was mapped, the calling principal is in the security role.