用户登录Java - JAAS / JNDI / GSSAPI

Question

What is the best way to design a user login mechanism using Java? What are the best practices to be followed to architect a secure and robust login mechanism?

What is the difference between JAAS, JNDI and GSSAPI? How do you decide which one to choose?

Answer 1

Single sign on (SSO) is one of hte best practices. Using one set of credentials for authentication (not necessarily authorization) for a group of applications. Sun's java based open source -- OpenSSO solution is available at https://opensso.dev.java.net/ . This includes OpenDS, an open source LDAP server.

few things you need to consider is
1) is it OK to let the user login simultaneously from multiple computers
2) how to mix authentication and authorization info in the same LDAP server

Some patterns in this area can be obtained from the book : http://www.coresecuritypatterns.com/patterns.htm

Answer 2

It depends on your user referential.

You need to be able to connect your login java module with that base. it is is LDAP, you might consider framework like OpenLDAP .

Plus you have to consider what is include in your "login" perimeter: It is is an "habilitation" login process, you need to have more that just the user name, but also other parameters helping your java module to grant him access (its group, which might be in LDAP, but also the kind of action he wants to make, in order to check if he has the required accreditation level)

Answer 3

I really like Spring Security . It's pretty easy to set up if you've got a Spring project, of course, but I've seen parts of it integrated into other implementations.