Notice: this Wiki will be going read only early in 2024 and edits will no longer be possible. Please see: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/wikis/Wiki-shutdown-plan for the plan.
Difference between revisions of "Jetty/Feature/JAAS"
| Line 12: | Line 12: | ||
| body = | | body = | ||
| − | Many application servers support JAAS as a means of bringing greater flexibility to the declarative security models of the J2EE | + | Many application servers support JAAS as a means of bringing greater flexibility to the declarative security models of the J2EE( now known as the Java EE) [http://java.sun.com/javaee/index.jsp specification]. Jetty support for JAAS provides greater alternatives for servlet security, and increases the portability of web applications. |
The JAAS support aims to dictate as little as possible whilst providing a sufficiently flexible infrastructure to allow users to drop in their own custom [http://java.sun.com/j2se/1.4.2/docs/guide/security/jaas/JAASLMDevGuide.html LoginModules]. | The JAAS support aims to dictate as little as possible whilst providing a sufficiently flexible infrastructure to allow users to drop in their own custom [http://java.sun.com/j2se/1.4.2/docs/guide/security/jaas/JAASLMDevGuide.html LoginModules]. | ||
Revision as of 11:45, 31 December 2009
Introduction
JAAS implements a Java version of the standard Pluggable Authentication Module (PAM) framework.
JAAS can be used for two purposes:
- for authentication of users, to reliably and securely determine who is currently executing Java code, regardless of whether the code is running as an application, an applet, a bean, or a servlet; and
- for authorization of users to ensure they have the access control rights (permissions) required to do the actions performed.
JAAS authentication is performed in a pluggable fashion. This permits applications to remain independent from underlying authentication technologies. New or updated authentication technologies can be plugged under an application without requiring modifications to the application itself. Applications enable the authentication process by instantiating a LoginContext object, which in turn references a Configuration to determine the authentication technology(ies), or LoginModule(s), to be used in performing the authentication. Typical LoginModules may prompt for and verify a username and password. Others may read and verify a voice or fingerprint sample.
Feature
Many application servers support JAAS as a means of bringing greater flexibility to the declarative security models of the J2EE( now known as the Java EE) specification. Jetty support for JAAS provides greater alternatives for servlet security, and increases the portability of web applications.
The JAAS support aims to dictate as little as possible whilst providing a sufficiently flexible infrastructure to allow users to drop in their own custom LoginModules.
Additional Resources
See Java&tm; Authentication and Authorization Service (JAAS) Reference Guide for more information about JAAS.