java - JAAS - How to authenticate user in web tier? -
i'm trying understand how secure java ee applications using jaas.
actually understand how work rules in ejbs, however, don't understand how authenticate user in web tier, example create simple jsf page login form, check given user name & password using db , in case of success how set principal user inside application.
what common way doing this? i'd have as-independent solution possible.
jaas not universal standard this. in fact, jaas login modules little ill-suited java ee authentication. full jaas model created java applications running locally, shielding code bases each other (e.g. specific jar allowed read file system).
it's rare java ee server run untrusted code, of functionality jaas offers not used.
two articles topic following:
what common way doing this?
unfortunately common using specific thing. terminology "thing" specific too. can called "realm", "security domain", "zone", "login module", , knows else call it.
i'd have as-independent solution possible.
fortunately there standard way in java ee 6 , beyond, as-independent: jaspic auth modules.
however, different application servers don't support this. of course being part of java ee standard means vendors must support it, still doesn't mean implement spec says (but instead implement sure tck tests for).
see following 2 articles wrote more info jaspic:
Comments
Post a Comment