0
# Security
1

2
Security APIs including JACC authorization, JASPIC authentication, and Java EE Security for identity management.
3

4
## JACC (Java Authorization Contract for Containers)
5

6
```java { .api }
7
public abstract class Policy {
8
    public static Policy getPolicy();
9
    public static void setPolicy(Policy p);
10
    public abstract boolean implies(ProtectionDomain domain, Permission permission);
11
    public abstract PermissionCollection getPermissions(CodeSource codesource);
12
    public abstract PermissionCollection getPermissions(ProtectionDomain domain);
13
}
14

15
public interface PolicyContext {
16
    String getContextID() throws PolicyContextException;
17
    Object getContext(String key) throws PolicyContextException;
18
    void setContextID(String contextID);
19
    void setHandlerData(Object data);
20
}
21
```
22

23
## Java EE Security
24

25
```java { .api }
26
public interface IdentityStore {
27
    CredentialValidationResult validate(Credential credential);
28
    Set<String> getCallerGroups(CredentialValidationResult validationResult);
29
    int priority();
30
    Set<ValidationType> validationTypes();
31
}
32

33
public interface HttpAuthenticationMechanism {
34
    AuthenticationStatus validateRequest(HttpServletRequest request, HttpServletResponse response, HttpMessageContext httpMessageContext) throws AuthenticationException;
35
    AuthenticationStatus secureResponse(HttpServletRequest request, HttpServletResponse response, HttpMessageContext httpMessageContext) throws AuthenticationException;
36
    void cleanSubject(HttpServletRequest request, HttpServletResponse response, HttpMessageContext httpMessageContext);
37
}
38
```
39

40
## Security Annotations
41

42
```java { .api }
43
@Target({ElementType.TYPE, ElementType.METHOD})
44
@Retention(RetentionPolicy.RUNTIME)
45
public @interface RolesAllowed {
46
    String[] value();
47
}
48

49
@Target({ElementType.TYPE, ElementType.METHOD})
50
@Retention(RetentionPolicy.RUNTIME)
51
public @interface PermitAll;
52

53
@Target({ElementType.TYPE, ElementType.METHOD})
54
@Retention(RetentionPolicy.RUNTIME)
55
public @interface DenyAll;
56
```
57

58
## Usage Example
59

60
```java
61
@Stateless
62
public class AdminService {
63
    
64
    @RolesAllowed("admin")
65
    public void deleteUser(Long userId) {
66
        // Only admin users can delete
67
    }
68
    
69
    @PermitAll
70
    public List<User> getPublicUsers() {
71
        // Anyone can access
72
        return userRepository.findPublicUsers();
73
    }
74
}
75
```