JSR-000058 Java TM 2 Platform, Enterprise Edition 1.3 Specification

■ Confidentiality or Data Privacy: The means used to ensure that information
is only made available to users who are authorized to access it.
■ Non-repudiation: The means used to prove that a user performed some
action such that the user cannot reasonably deny having done so.
■ Auditing: The means used to capture a tamper-resistant record of security
related events for the purpose of being able to evaluate the effectiveness of
security policies and mechanisms.
This chapter specifies how the J2EE platform addresses some of these security
requirements, and identifies those requirements left to be addressed by J2EE
Product Providers. Issues being considered for future versions of this
specification are briefly mentioned in Section 3.7, “Future Directions.”
3.2 A Simple Example
The security behavior of a J2EE environment may be better understood by
examining what happens in a simple application with a web client, JSP page
user interface, and enterprise bean business logic. We include here a descriptive
example; this example is not meant to specify requirements. In this example, the
web client relies on the web server to act as its authentication proxy by
collecting user authentication data from the client and using it to establish an
authenticated session.
Step 1: Initial Request
The web client requests the main application URL, shown in FIGURE 3-1.
Web Client
Request access to
protected resource
FIGURE 3-1 Initial Request
Web Server
Since this client has not yet authenticated itself to the application environment,
the server responsible for delivering the web portion of the application
(hereafter referred to as “web server”) detects this and invokes the appropriate
authentication mechanism for this resource.
3-2 Java 2 Platform Enterprise Edition, v1.3 Proposed Final Draft (Sun Microsystems, Inc.)