Doing Business with Enterprise JavaBeans

by George Reese

Most people familiar with Java have encountered its standard component model for client-side objects, JavaBeans. Through a simple programming contract, you can build Java components that others can employ in diverse applications using standard Java IDEs. Although nothing restricts you from developing “server-side” components, like business objects using the JavaBeans specification, you will find yourself limited to a single virtual machine environment. JavaBeans does not provide direct support for components that need to operate in a distributed, persistent, and secure environment. Because business objects need such an environment, Sun and its partners created a component model built around these needs: Enterprise JavaBeans (EJB). We will explore the special needs of an enterprise computing environment and how the EJB specification attempts to meet these needs.

Enterprise computing

Any enterprise computing solution must focus on modeling business concepts without imposing restrictions on business processes. For example, you do not want your business software to dictate that your worldwide offices operate in English. You may choose English for other non-technical reasons, but you should never let technology drive business processes. Thus the key to proper business modeling is to capture your business concepts in reusable, re-packageable components. These components must meet the following requirements:

• An enterprise business component must be accessible from any place at any time using security that can support multiple classes of users. You want a business component that can support both Web access for customers, extranet access for vendors, and intranet access for employees.
• An enterprise business component may require persistence. In other words, it may need to remember its state across time. When the server goes down, that business component must come back up on that server or on another server in the exact same state as it was in when the server went down. Not all components will require persistence, but an enterprise component model must support both persistent and transient components.
• An enterprise business component must place only minimal standards-based requirements on those who use it. In short, it should be platform independent and be able to persist against a number of different persistence models. While you may be able to control what environment your employees work in, you cannot control the computing environments of your customers, clients, vendors, or distributors. By avoiding proprietary solutions, you maximize the potential clients of your business components.
• An enterprise business component should be free of cultural bias. Beyond the obvious requirement for internationalization and localization, it also means a component should abstract from the particular quirks of your local department, so other departments and your business partners can use it.
• An enterprise component must be the authoritative reference for the business concept it represents. In a banking system, for example, a single, logical business component represents Savings Account #129936432. This component may be made up of multiple objects, but those objects should be working together to maintain a single, logical point of reference for any potential clients.

EJB roles

The specification first identifies different roles in the business component world. The key roles are as follows:

• The EJB Provider — An EJB provider is an expert in the business concepts at hand and is the author of the Java classes that model those concepts. These Java classes exist independent of any particular application in which they might appear.
• The Application Assembler — An application assembler is an expert in the processes of a business and is the author of a complete application built from the business components developed by one or more EJB providers.
• The Deployer — A deployer is an expert in a particular operating environment. The deployer takes an assembled application and configures it to the specifics of the environment in which it will run. This job may include, for example, indicating how to map the attributes of a business component to the corporate database.
• The EJB Server Provider — A server provider provides one or more system-level services, such as distributed transaction management.
• The EJB Container Provider — A container provider provides the runtime environment for an EJB.
• The System Administrator — A system administrator maintains the system’s runtime environment over the course of its life-cycle.

The current specification focuses almost entirely on the work of the EJB provider. As a business object developer, the provider is you. Every other role makes use of the business objects you develop. Of those roles, only the container is of interest in this article. The container is the place where your business objects live. It thus manages the key functions of an enterprise component such as security and persistence.

Types of beans

The EJB specification calls transient business objects “session beans.” They come in two flavors: stateful and stateless. A stateful session bean shares values between two method calls. If you set an attribute in a stateful session bean by calling one method and then call a second method, that attribute will still be set to the value you assigned it. A stateless session bean, on the other hand, does not maintain any state information across method calls. Both kinds of session beans have a one-to-one relationship with a client. If, for example, we had a login session bean, the ATM machine would reference a different login session bean from the Web client.

Distributed beans

Your options on how you deploy the bean, however, are entirely dependent on the server provider you use. The server provides the distributed computing services for your runtime environment. If it relies entirely on Java RMI and JRMP (RMI’s native network protocol), you will end up with an application that cannot scale due to the limitations of JRMP (lack of failover support, protocol speed, and out-of-control socket creation). A good server can work in pure-CORBA, pure-RMI, and RMI-IIOP environments.

Bean persistence

The most common persistence mechanism in use today is something called “bean-managed persistence.” As its name implies, bean-managed persistence places the burden of persistence management on the JavaBean developer. You implement the persistence methods from the EJB specification to perform persistence operations like the creation, deletion, loading, or updating of an EJB with respect to its data store.

The other kind of persistence is “container-managed persistence.” Here, a bean developer is not at all concerned with persistence issues. Instead, the bean developer focuses entirely on the business logic of business components. You can configure the container at deployment time to make those objects persist against a particular data source and data model.

In an ideal world, there is absolutely no reason you would use anything other than container-managed persistence. In the real world, however, you do not want to touch container-managed persistence until the 2.0 version of the EJB specification is released. The most glaring design fault with the EJB specification is that it requires all attributes for container-managed beans be public. Public attributes are, of course, a sacred no-no of object-oriented software engineering. Unfortunately, EJB must require public attributes, because there is absolutely no way under JDK 1.1 to let a specific class get access to an object’s state unless the state is all public. The JDK 1.2 specification provides a questionable tool that enables any class to get access to another class’s private attributes. Using this tool, the

setAccessible()

Another problem with container-managed persistence lies not in the specification, but in the container implementations themselves. First of all, since containers are not even required to support entity beans, much less container-managed persistence, you cannot rely on that support even to exist. Finally, practical experience is showing that most people run into implementation problems when relying on container managed persistence due to the general immaturity of the products currently available.

Security

Depending on the server you use, your network communications may or may not be secure. You need a container that uses some sort of SSL security if you intend to deploy an application where secure data is being transmitted.

Due to the lack of direction on authentication and validation, you may see a huge variation in the way different containers implement their pieces of the security puzzle. Application assemblers will potentially need to retool their applications for serious changes when EJB 2.0 comes out. You should, therefore, look for a container that provides good tools for the deployer and system administrator to manage security configuration.

EJB in an enterprise environment

Related articles

• The Enterprise JavaBeans architecture

About the author