JAAS for human beings

by

Other users have provide some very useful links above so I am not going to bother with links. I have done a similar research in JAAS for web application and has ran into a “mind roadblock” until I finally realize JAAS is a framework tackling security at a different “layer” then web applications in the Java World. It is build to tackle security issues in Java SE not Java EE.

JAAS is a security framework built for securing things at a much lower level then web-application. Some example of these things are code and resources available at the JVM level, hence all these ability to set policy files in the JVM level.

However, since Java EE is built on top of Java SE, a few modules from JAAS were reused in Java EE security such as the LoginModules and Callbacks.

Note that in addition to Java EE security, there is also Spring security (formerly known as Acegi), which similar to native Java EE security tackles a much higher “layer” in the securing web-application problem. It is a separate security implementation and is not built on top of standard Java EE security, although it behaves similarly in many regards.

To summarize, unless you are looking to secure resources in the Java SE level (classes, System resources), I don’t see any real use of JAAS other than the using the common class and interfaces. Just focus on using Spring Security or plain old Java EE security which both solve a lot of common web application security problems.

More Related Contents:

  1. Spring Security : Multiple HTTP Config not working
  2. Unit testing with Spring Security
  3. Spring Security, secured and none secured access
  4. How to apply Spring Security filter only on secured endpoints?
  5. How to fix role in Spring Security?
  6. Spring security CORS Filter
  7. How to create custom methods for use in spring security expression language annotations
  8. Configuring Spring Security 3.x to have multiple entry points
  9. How to manage exceptions thrown in filters in Spring?
  10. Difference between Role and GrantedAuthority in Spring Security
  11. Disable Spring Security for OPTIONS Http Method
  12. How to enable HTTP response caching in Spring Boot
  13. RESTful Authentication via Spring
  14. HttpSecurity, WebSecurity and AuthenticationManagerBuilder
  15. Spring webSecurity.ignoring() doesn’t ignore custom filter
  16. Spring security does not allow CSS or JS resources to be loaded
  17. how to display custom error message in jsp for spring security auth exception
  18. Spring Security 5 : There is no PasswordEncoder mapped for the id “null”
  19. Securing Spring Boot API with API key and secret
  20. Spring Security multiple url ruleset not working together
  21. How to use new PasswordEncoder from Spring Security
  22. Spring security added prefix “ROLE_” to all roles name?
  23. When to move from Container managed security to alternatives like Apache Shiro, Spring Security?
  24. Why this Spring application with java-based configuration don’t work properly
  25. How to reload authorities on user update with Spring Security
  26. How do I disable resolving login parameters passed as url parameters / from the url
  27. Single role multiple IP addresses in Spring Security configuration
  28. Disabling a filter for only a few paths
  29. How to secure REST API with Spring Boot and Spring Security?
  30. Why BCryptPasswordEncoder from Spring generate different outputs for same input?

Leave a Comment