[jboss-dev-forums] [Design of JBoss jBPM] - commands & EJB 3

Hi! For the jbpm commands there is a CommandService-Implementation as EJB 2.1 SessionBean: org.jbpm.ejb.impl.CommandServiceBean First of all: There is no EJB 3 SessionBean available, right? And because the Java 1.4 compability is still required we only can build a EJB 3 SessionBean in our own toolkit for jBPM, not the jbpm core, right? Also we use JAAS to autheticate users (to have different groups for deploying processes, signalling, cancelling, ...). We have annotated this in our EJB 3 Bean (e.g. @RolesAllowed( {"jbpm-admin-write"}) ). How can we do that with the commands? One really generic and easy solution which came into my mind, is just to have the Command-Class-names as roles in JAAS (ok, not so nice for the administration) and then check, if the JAAS user is in the role in the SessionBean, so the JAAS-Logic is only in the SessionBean, nowhere else. What do you think? Or hardcode 3 or 4 roles in the commands and check for them? So everybody which needs different roles has to overwrite the commands? Or any complete different approaches (like configuring that in a external configuration)? Regards Bernd View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4011900#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...