j2ee security

[john307rnr]

first of all i have to say that i am a bloody beginner in the j2ee environment. i read a lot of the docu that is out there but things aren't getting much clearer. But now to my problem:

the application i am working on (JSP frontend, some java beans and servlets) has a custom security class. it is my job to implement the functionality of the current security with the built in j2ee security. but also the j2ee built in security has to be adjusted to do authorization and authentification without xml files and with a database. i read that oracle has developed it's own jaas provider (JAZN)that fits in tomcat and orion. damn i know that the information i gave to you is probably confusing but it's the best i can tell you till know. i go an have a coffee. thanks !

 

[john307rnr]

i forget the question: does anybody know if the things i told you above are possible to implement ? does andybody have some experience with it ?

 

[sedj]

J2EE is basically just an extension & API ... its not an "out of the box" type thing.

What "security" do you mean ? There is no real "built in" security that you mention, you must employ APIs lie JAAS in order to get "security" ...

What do you want ? Basic SSL over HTTP for login, or for all web pages, or do you want to implmenet some kind of custom encryption algorithm or what ?

Considering that banks just use clear text passwords over SSL, I would think you are being paranoid if doing anything else over HTTP, and making life VERY difficult for yourself ...

--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[john307rnr]

i mean the built in security with which you can limit the users access to web resources. it's an xml file where you supply an URI and a rolename that can access the given URI. i "think" that this feature comes with JAAS. and i also "think" that JAAS's methods isUserInRole() ... are used to evaluate the XML files. now i want to overwrite/reimplement JAAS's isUserinRole() ... to do a DB lookup. Please tell me if i'm totally wrong or if you know a (better) solution.