10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Examples: SecuringWeb Applications<br />

FIGURE 30–5 User Name- and Password-Based Mutual Authentication<br />

Digest Authentication<br />

Like HTTP basic authentication, HTTP Digest Authentication authenticates a user based on a<br />

user name and a password. However, the authentication is performed by transmitting the<br />

password in an encrypted form which is much more secure than the simple Base64 encoding<br />

used by basic authentication. Digest authentication is not currently in widespread use, and is<br />

not implemented in the Application Server, therefore, there is no further discussion of it in this<br />

document.<br />

Examples: SecuringWeb Applications<br />

862<br />

3<br />

Verifies<br />

certificate<br />

Client<br />

trustStore<br />

server.cert<br />

1<br />

Requests protected resource<br />

2<br />

Presents certificate<br />

4<br />

Sends username:password<br />

5<br />

Accesses protected resource<br />

server.keystore<br />

server.cert<br />

Server<br />

<strong>The</strong>re are several ways in which you can secure web applications. <strong>The</strong>se include the following<br />

options:<br />

■ You can define a user authentication method for an application in its deployment<br />

descriptor. Authentication verifies the identity of a user, device, or other entity in a<br />

computer system, usually as a prerequisite to allowing access to resources in a system. When<br />

a user authentication method is specified for an application, the web container activates the<br />

specified authentication mechanism when you attempt to access a protected resource.<br />

<strong>The</strong> options for user authentication methods are discussed in “Specifying an Authentication<br />

Mechanism” on page 854. All of the example security applications use a user authentication<br />

method.<br />

<strong>The</strong> <strong>Java</strong> <strong>EE</strong> 5<strong>Tutorial</strong> • June 2010

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!