Win a copy of Pipeline as Code this week in the Cloud/Virtualization forum!
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Ron McLeod
  • Paul Clapham
  • Jeanne Boyarsky
  • Bear Bibeault
Sheriffs:
  • Rob Spoor
  • Henry Wong
  • Liutauras Vilda
Saloon Keepers:
  • Tim Moores
  • Carey Brown
  • Stephan van Hulst
  • Tim Holloway
  • Piet Souris
Bartenders:
  • Frits Walraven
  • Himai Minh
  • Jj Roberts

Doubt regarding configuring Authentication System for JEE application (Web + EJB)

 
Ranch Hand
Posts: 82
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Hi,
I have an application with JSF as view and EJB for the model. I need to authenticate the users on both the web tier and EJB tier. Ideally I would authenticate the user on the web side and propagate the authenticated principal to the EJB tier. My doubt is whether I have to include the Security configuration on both web and EJB tier or is it enough to have it configured on the web tier(web.xml) and the container then propagates the authenticated principal to the EJB tier.

regards,
Nirvan.
 
Greenhorn
Posts: 8
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Hi Nirvan!
Once the user (web tier) has been authenticated via JAAS, the client can call ejbs securely. The authentication is propagated to the ejb upon method invocation.

You should supply different configurations for the web and EJB tiers.

In the web.xml you specify the the authentication method and security constraints for your pages.

In the EJB deployment descriptor (or annotations ) you specify the security roles allowed for method invocations.

They share the same authentication but the configuration is different.
 
B Nirvan
Ranch Hand
Posts: 82
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Thiago,
Thanks very much for the explanation. Doubt resolved.

regards,
Nirvan
 
There is no beard big enough to make me comfortable enough with my masculinity to wear pink. Tiny ad:
SKIP - a book about connecting industrious people with elderly land owners
https://coderanch.com/t/skip-book
reply
    Bookmark Topic Watch Topic
  • New Topic