如何在Glassfish的JSF中实现认证？

Question

I have an embedded glassfish server and a small web app. I want to add login-authentification thingy to it. Problem: all tutorials i've found so far tell to go glassfish admin console on 4848 port and config jdbc realm there. Is it's possible to do this using xml files like web.xml , glassfish-resources.xml and provide them with my war. It would be nice to make my app completely portable. Thanks in advance!

Answer 1

您是否考虑过简单地创建用于输入用户名/密码的安全表单，然后仅检查数据库中的表单？

Answer 2

According to the Java EE 6 specifications (and to the Java EE 6 tutorial, chapter Overview of Java EE Security ):

Security for components is provided by their containers

So, using the standard Security concepts, it's not wise to make your web application aware of realms and other features that should be managed by the container.

In theory there is a way for reaching your goal, but it's very complex and at the end of the day it's not even fully container-agnostic. This way consists in developing your own JAAS (Java Authentication and Authorization Service), and deploying it into the container before deploying your application.

You can find further reference in this JAAS Tutorial , from which I extract the following lines that explain the concept I have summarized above:

System level security is defined in terms of User Groups, called Roles, and in terms of security privileges mapping definitions, called Realms. Application level security is constituted from User Groups and Realms.

At the application level, security permissions also list the various application components that are accessible by each User Group in each Realm. Thus, when an application is deployed, its application level realms and roles are mapped to the system level realms and roles defined on the server.