中文摘要：

安全与授权问题是企业应用的关键问题,而目前J2EE规范中的安全授权服务缺乏足够的安全描述能力。提出支持XACML安全策略的安全授权框架,为J2EE应用服务器的各个组件描述复杂的安全逻辑,并提供灵活的安全授权服务,降低了企业应用开发以及系统维护的成本。该框架在中科院软件所自主研发的J2EE应用服务器OnceAS中得到实现。

英文摘要：

Security and authorization play a very important role in the enterprise applications. However, the lack of powerful descriptive ability prevents security service from representing the complex access control logic for the components of J2EE application server. The security authorization framework supporting XACML policy can provide a descriptive way to fulfill complicated access control business for the components of the application server and reduce the cost of developing enterprise application. This framework is implemented in the J2EE application server OnceAS.