J2EE Security Design Question

[Ryan Pape]

I have a J2EE app where there is a one-one correspondence between the
JAAS user an an Entity bean (user EJB). As far as I know, there is no
way to automatically bind the two together so retrieveing the entity
bean associated with a user is done by something like,
UserHome.findByPrimaryKey(name_from_principal).

I have a stateful session bean, call it "Manager", that executes
actions to underlying entity beans for a particular user.

I have another entity bean, "file", which upon creation must be given
a reference to a third entity bean that can be dervied by looking at
the user entity bean I described above.

So my question is, from a design & performance perspective:

Is it better to, in ejbCreate methods for the file entity bean,
perform the lookup to get a user entity bean from the security
Principal each time

or

store a reference to the user entity bean in my stateful session bean
and pass it as a parameter to the create() method on my file entity
bean.

Any opinions would be appreciated.

 

[Bryce (Work)]

I have a J2EE app where there is a one-one correspondence between the
JAAS user an an Entity bean (user EJB). As far as I know, there is no
way to automatically bind the two together so retrieveing the entity
bean associated with a user is done by something like,
UserHome.findByPrimaryKey(name_from_principal).

What Application server are you using? JBoss has a Database Login
Module...