Security, Transactions, and Messaging
Domain 8 bundles three container services that questions often combine: declarative security, container-managed transactions and JMS 2.0 messaging.
Security
- Declarative controls are @RolesAllowed, @PermitAll, @DenyAll, @RunAs and @DeclareRoles in code, plus security-constraint, login-config (BASIC, DIGEST, FORM, CLIENT-CERT) and transport-guarantee CONFIDENTIAL in web.xml. @ServletSecurity and @HttpConstraint do the same for servlets.
- Programmatic checks use HttpServletRequest.isUserInRole, login and logout; Servlet 3.1 adds authenticate and logout. JASPIC plugs in a ServerAuthModule for custom authentication.
Transactions
- @TransactionAttribute values: REQUIRED (the default, join or start), REQUIRES_NEW (suspend and start), MANDATORY, NEVER, NOT_SUPPORTED and SUPPORTS.
- An unchecked exception such as RuntimeException or EJBException marks the transaction rollback-only; a checked exception does not, unless it carries @ApplicationException(rollback=true) or the bean calls setRollbackOnly(). JTA 1.2 @Transactional brings the same attributes to CDI beans.
- setRollbackOnly() does not stop execution; the transaction runs to completion and then rolls back.
Messaging
- JMS 2.0 simplifies injection with @Inject JMSContext, @JMSConnectionFactoryDefinition, @JMSDestinationDefinition, JMSProducer and JMSConsumer.
- Queues are point-to-point with one consumer per message; topics are publish-subscribe and need durable subscriptions for offline subscribers.
- @MessageDriven beans consume using @ActivationConfigProperty entries such as destinationLookup, destinationType and messageSelector.
Worked example
A bean method marked REQUIRES_NEW is called from inside an existing transaction. The container suspends the outer transaction and starts a second one, so if the outer transaction later rolls back, the inner work has already committed. That is the specified behaviour and a frequent exam answer.
Traps
- Assuming checked exceptions roll back a container-managed transaction.
- Expecting @RolesAllowed on a plain CDI bean to enforce anything at all.
- Assuming topic messages reach offline subscribers without durable subscriptions.