JAAS or j_security_check

[Krishna Das]

Hi

I am new to JAAS. I have used j_security_check(of JBOSS) in a couple of projects.

I wanted to know the advantages of using JAAS over j_security_check. Basically I want to know when to use what?(JAAS and j_security_check or others....)

[Ulf Dittmer]

Welcome to JavaRanch.

It's not an either-or proposition - both can be used together. JAAS is a much more comprehensive authentication/authorization solution, which consequently is more difficult to set up and has a stepper learning curve.

E.g., Tomcat can hook its web app security into JAAS. I would expect JBoss to be able to do something similar.

If you're interested in using JAAS in a web app, check out jGuard; it's meant to simplify that.

[Krishna Das]

Hello Ulf,

Thanks for the reply. But are there any pointers where we can find a comparison study of the same?

Also I am unable to do URL authorization using JAAS. I just didn't find anything comprehensive on the net(apart from the tutorial from www.moore.com).

Thats the reason why I wanted to compare JAAS and j_security_check(for evaluation).

Also the project which I am working on currently, would be deployed on GlassFish v2(I have no idea of GlassFish... I am new to it)

Thanks for the Info.

[Ulf Dittmer]

Correct, JAAS is not web app-specific, and so it has no mechanism to be mapped to URLs. That's where the jGuard project I pointed you to comes in handy.

You can't really compare JASS and web app security, as they are targeted towards different scenarios. Generally, you only need to use JAAS if the username/role concept provided by web app security is not sufficient. For many web apps, it is sufficient.

It should also be pointed out that often people do not use web app security, but rather develop their own, because what web app security provides is rather limited. But in those cases, too, JAAS is not often used due to its complexity.

[Krishna Das]

Hi Ulf,

I am not supposed to use JGuard in my project. My client really doesn't want to use open source software in the project. So I stuck to JAAS because I had 3 fields(key, username and password) for authentication.

I somehow managed to get it to work. Thanks for the pointers.

Three cheers to JavaRanch.

Regards