The same mechanism works regardless of whether you launch the app client using the appclient command or the built-in Java Web Start support. It is described in the spec (section EE 3.4.4 and EE 9.7) and in the documentation. The spec talks about both the responsibilities of the app client container (which GlassFish supplies) and the application client (which you supply).
Basically, you need to provide an implementation of the javax.security.auth.callback.CallbackHandler interface in your app client and point to it by adding the <callback-handler> element to your application-client.xml descriptor. Then, whenever authentication is required, your class is instantiated and used to gather the credentials.
Search this forum and/or Google for examples.
- Tim
[Message sent by forum member 'tjquinn' (tjquinn)]
http://forums.java.net/jive/thread.jspa?messageID=268339