Question

I have an embedded glassfish server and a small web app. I want to add login-authentification thingy to it. Problem: all tutorials i’ve found so far tell to go glassfish admin console on 4848 port and config jdbc realm there. Is it’s possible to do this using xml files like web.xml, glassfish-resources.xml and provide them with my war. It would be nice to make my app completely portable. Thanks in advance!

Answer 1

According to the Java EE 6 specifications (and to the Java EE 6 tutorial, chapter Overview of Java EE Security):

Security for components is provided by their containers

So, using the standard Security concepts, it’s not wise to make your web application aware of realms and other features that should be managed by the container.

In theory there is a way for reaching your goal, but it’s very complex and at the end of the day it’s not even fully container-agnostic. This way consists in developing your own JAAS (Java Authentication and Authorization Service), and deploying it into the container before deploying your application.

You can find further reference in this JAAS Tutorial, from which I extract the following lines that explain the concept I have summarized above:

System level security is defined in terms of User Groups, called
Roles, and in terms of security privileges mapping definitions, called
Realms. Application level security is constituted from User Groups and
Realms.

At the application level, security permissions also list the
various application components that are accessible by each User Group
in each Realm. Thus, when an application is deployed, its application
level realms and roles are mapped to the system level realms and roles
defined on the server.