The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

■ You can define a transport guarantee for an application in its deployment descriptor. Use
this method to run over an SSL-protected session and ensure that all message content is
protected for confidentiality or integrity. The options for transport guarantees are discussed
in “Specifying a Secure Connection” on page 853.
When running over an SSL-protected session, the server and client can authenticate one
another and negotiate an encryption algorithm and cryptographic keys before the
application protocol transmits or receives its first byte of data.
SSL technology allows web browsers and web servers to communicate over a secure
connection. In this secure connection, the data is encrypted before being sent, and then is
decrypted upon receipt and before processing. Both the browser and the server encrypt all
traffic before sending any data. For more information, see “Establishing a Secure
Connection Using SSL” on page 783.
Digital certificates are necessary when running HTTP over SSL (HTTPS). The HTTPS
service of most web servers will not run unless a digital certificate has been installed. Digital
certificates have already been created for the Application Server.
The following examples use annotations, programmatic security, and/or declarative security to
demonstrate adding security to existing web applications:
■ “Example: Using Form-Based Authentication with a JSP Page” on page 863
■ “Example: Basic Authentication with a Servlet” on page 873
■ “Example: Basic Authentication with JAX-WS” on page 881
■ “Discussion: Securing the Duke’s Bank Example” on page 829
Examples: SecuringWeb Applications
The following examples demonstrate adding basic authentication to an EJB endpoint or
enterprise bean:
■ “Example: Securing an Enterprise Bean” on page 818
■ “Example: Using the isCallerInRole and getCallerPrincipal Methods” on page 823
■ “Discussion: Securing the Duke’s Bank Example” on page 829
Example: Using Form-Based Authentication with a JSP
Page
This example discusses how to use form-based authentication with a basic JSP page. With
form-based authentication, you can customize the login screen and error pages that are
presented to the web client for authentication of their user name and password. When a user
submits their name and password, the server determines if the user name and password are
those of an authorized user and, if authorized, sends the requested web resource. If the topic of
authentication is new to you, please refer to the section “Specifying an Authentication
Mechanism” on page 854.
In general, the following steps are necessary for adding form-based authentication to an
unsecured JSP page, such as the one described in “Web Modules” on page 81. In the example
Chapter 30 • SecuringWeb Applications 863