The security mechanisms described in the Authentication and Authorization sections are sufficient for most J2EE applications. You control these mechanisms by declaring certain parameters with the Application Deployment Tool. Because this approach is declarative, you don't have to code your own security routines.
Some applications have special security requirements.
For example, an application might make authorization decisions based on the time of day, the parameters of a call, or the internal state of an enterprise bean. Another application might restrict access based on user information stored in a database. If your application has special security requirements, you may want to take advantage of the APIs described in the following sections. The getCallerPrincipal method of the EJBContext interface returns the java.security.Principal object that identifies the caller of the enterprise bean. When you are ready to deploy the application, you must link the coded name with a role name.