Getting Started with WebSphere Application Server

Chapter 8 – Security 153
In the above example, the realm helloRealm is used. Ensure you add the following line to the
deployment plan (geronimo-web.xml):
helloRealm
The BASIC authentication mechanism is the default option for requesting authentication information from
a browser-based client. When a user tries to access the protected pages using a browser, the browser
will pop-up a dialog box to request you input the id and password. The authentication information is
encrypted using base64 encoding.
Alternatively, the FORM authentication mechanism as illustrated in Listing 8.14 is also commonly used.
Using this mechanism, an application developer provides a customized logon page, and you request the
authentication information this way. This is illustrated in Listing 8.15 showing the contents of the file
login.jsp.
FORM
/login.jsp
/loginerror.jsp
Listing 8.14 - “FORM” authentication method
Username:
Password:
Listing 8.15 - The login.jsp
There are also Client_CERT and Digest methods provided, where Client_CERT is using digital
certificates passed over an SSL connection, and Digest is similar to BASIC, but the password is
transmitted using a custom encryption mechanism.
8.3.3.2 Programmatic security
Using programmatic security in JSPs and servlets is very similar to EJB programmatic security described
in an earlier section. Listing 8.16 provides an example.
System.out.println(request.getUserPrincipal().getName());
if (request.isUserInRole("super_user")){
//add any logic that is super user specific.
}
Listing 8.16 - Programmatic access control
8.3.3.3 Testing Web security from a browser