J_security_check and JAAS

Question

I was tasked with implementing an input handler. The only detail that the handler captures is the username and password. I originally intended to use the JSP that was sent to the servlet. Where the servlet did a db lookup and also checked the user credentials. Upon successful login, you are redirected, but unsuccessfully returns you back to jsp and displays the corresponding error messages.

However, after doing some research, I discovered j_security_check and JAAS and am not sure what to use or not at all.

What benefits will I get from that, and what will be most suitable for my task?

Answer 1

Security consists of the following aspects:

• Authentication
• Resolution
• Transport Layer Security - Encryption

Authentication: - This is a verification of user credentials; in most cases, this is done through an input mechanism. Your task of creating a login page is part of authentication.

Authorization: - application resources must be protected from unauthorized access, which means that when a user requests a protected resource, the application must ensure that the user has the appropriate access rights. This is usually done by assigning roles to the user and installing query filters that check the user's access rights. This part is more important and requires a detailed design analysis. Just user authentication is not enough, you need to ensure that protected resources are not available to those users who are not authorized for them.

Transport layer security: - The system architecture must ensure that data transmitted over the network does not fall into the hands of hackers or sniffers. SSL / TSL is used to achieve this.

J2EE containers and frameworks such as Spring provide common functions for every aspect of security.

What you are trying to develop is a simple authentication mechanism. Application security requires more when it comes to access control, i.e. authorization.

In addition, security requires scalable, for example, to change the business needs for system integration and security, which your system must adapt to such things as Single Sign On (SSO), LDAP authentication, etc.

Although JAAS and container security are good enough to scale, there are a few limitations with the same. For example, you will need to depend on the specific configurations and adapters of a particular provider. Your application will declare security needs for deployment descriptors, and server administrators must configure security areas on the server.

I would recommend you evaluate the Spring Security infrastructure (formerly Acegi Security). We used the same in many of our projects and found it reliable, customizable and easy to implement. It comes with a set of filters that intercept your request and provide access control. The Framework can be used to validate users against various user repositories such as database, LADP servers, OS security, etc. It is extensible and can be integrated with SSO servers. It also provides useful taglibraries for controlling access to parts on JSP pages. Not only does this structure also provide method-level security, which can be superimposed at the class level through the Spring AOP framework

Answer 2

Use what the container provides and do not search the database to do this. When a container knows who is logged in, you can use roles to restrict access to certain pages. There are also various types of authentication.

Using JAAS will give you the opportunity to use a different password verification method (for example, in the active directory). In addition, a single entry can be implemented with this.

Answer 3

A simpler method should be sufficient if you are not doing really very sensitive things. Just remember the most important (and simplest) bit: store the password hash in the database, not the real password.

Answer 4

You can also check Spring Security .

Answer 5

JAAS takes the load off of you and allows (or the client) to change authentication methods by simply dropping another module. For example, from auth DB to LDAP to Kerberos in NT Domain - you get the point.