Question

I got hand-written security, simple servlet-filter which redirect not-authorized user to their login pages. Login controller redirect them to the requested URL after successfull authentication or their main page. This approach work fine, the only disadvantage, that I have to pass User object which is stored in the HttpSession through stacktrace to EJB beans.

Now I rewrote some code and use Spring-security as http based authentication. It is integrated automatically with Glassfish JAAS.

I don’t need to pass User through stacktrace anymore, invocation sessionContext.getCallerPrincipal() is enough. But the principal object return me only userName, not userId, so i have to perform addition select if i need userId for example.

1) Is there anyway to extend Principal object, so it can store more properties ?

2) Why i should use JAAS or Spring Security or another security framework, why not just hand writen servlet filter ?

Answer 1

2) Using a standard security mechanism like JAAS has many advantages:

1. You can easily change the way user authenticates solely by configuring your server – without need to change anything inside your code.

2. You can be sure your security is up-to-date, supporting strongest algorithms, storing Principal in a secure manner and so on. Again just by staying up-to-date with your server, framework etc. Having a hand-written security module is prone to errors and to be outdated soon.

3. You can leverage framework security – eg. web.xml security tags, EJB security annotations. Because JAAS is a standard way to authenticate, you can be sure adopting future technologies will be easier, because all serious technologies will support JAAS (Spring security etc.). If your software is planned to grow, you will definitely need a standard.

4. It will save you time and effort. JAAS provides both authentication and authorization, neatly packed and configurable within minutes.

5. I recommend futher reading on J2EE security or you can find more resources in OWASP guides.