users@glassfish.java.net

Re: Deploying JAAS modules in EAR

From: <glassfish_at_javadesktop.org>
Date: Wed, 01 Oct 2008 09:35:35 PDT

> Is there any tutorial about how to use jsr 196 in
> Glassfish?

currently Glassfish employs JSR 196 to offer security mechanism integration points in the servlet container for web tier (HttpServlet layer authentication), and inthe Servlet and EJB containers for web service (i.e. SOAP message authentication) Glassfish does not currently offer an EJB container mechanism integration point for non web service based invocations of EJBS. So before you go to far down this path, you need to decide if you can get by with being able to configure a new authentication mechanism in one of the supported places. If so, the following example describes how to inject a mechanims in the web container. The same principals apply to the SOAP interception points (and I can provide more detail in either case).

http://blogs.sun.com/enterprisetechtips/entr/adding_authentication_mechanisms_to_the

> The problem with the traditional JAAS authentication
> is that it depends on some EJBs that are specific to
> the application so deploying them separately (and
> globally) is not really necessary or even a good
> idea, so I'd like to have an authentication mechanism
> that is specific to the application and nothing else.
> I hope jsr 196 provides this.

jsr 196 allows you to define mechanisms that in effect become internal to the containers, where they can be configured for use by one or more deployed applications.
I think this satisfies the criteria you describe above.

Ron
[Message sent by forum member 'monzillo' (monzillo)]

http://forums.java.net/jive/thread.jspa?messageID=302766