Sun Java System Application Server Platform Edition 8.1 2005Q2 Update 2 Administration Guide

- Previous: Managing Security of Passwords
- Next: About Authentication and Authorization

### Assigning Security Responsibilities

Security responsibilities are assigned to the following:

- Application Developer

- Application Deployer

- System Administrator

#### Application Developer

The application developer is responsible for the following:

- Specifying roles and role-based access restrictions for application components.

- Defining an application’s authentication method and specifying the parts of the application that are secured.

An application developer can use tools such as `deploytool` to edit application deployment descriptors. These security tasks are discussed in more detail in the Security chapter of The J2EE 1.4 Tutorial, which can be viewed at `http://java.sun.com/j2ee/1.4/docs/tutorial/doc/index.html`.

#### Application Deployer

The application deployer is responsible for:

- Mapping users or groups (or both) to security roles.

- Refining the privileges required to access component methods to suit the requirements of the specific deployment scenario.

An application deployer can use tools such as `deploytool` to edit application deployment descriptors. These security tasks are discussed in more detail in the Security chapter of The J2EE 1.4 Tutorial, which can be viewed at `http://java.sun.com/j2ee/1.4/docs/tutorial/doc/index.html`.

#### System Administrator

The system administrator is responsible for:

- Configuring security realms.

- Managing user accounts and groups.

- Managing audit logs.

- Managing server certificates and configuring the server’s use of secure sockets layer (SSL).

- Handling other miscellaneous system-wide security features, such as security maps for connector connection pools, additional JACC Providers, and so on.

A system administrator uses the Admin Console to manage server security settings and `keytool` to manage certificates. This document is intended primarily for system administrators.

- Previous: Managing Security of Passwords
- Next: About Authentication and Authorization

- © 2010, Oracle Corporation and/or its affiliates