Oracle JHeadstart Developer's Guide - Downloads - Oracle

10.1. Understanding and Choosing Security Options with JHeadstart
10.1.1. JAAS and JAZN
Generally speaking, there are two popular ways to implement authentication (“who is
the current user”) and authorization (“is the current user allowed to do this”) in Java EE
web applications:
• Container-managed security using JAAS (Java Authentication and Authorization
Service)
• Custom security
JHeadstart supports both types of security, and even allows you to combine both
approaches by using custom roles and/or permissions in addition to JAAS-based
security. This paragraph discusses the security options in more detail, which should
help you in configuring the JHeadstart security settings in your Application Definition
(at Service level).
Within the JEE platform, Java Authentication and Authorization Services (JAAS) is the
standard for implementing security. By using JAAS the web container used to run the
web application enforces proper authentication and authorization (“container-managed
security”). Each web container provides its own implementation of the JAAS standard.
JAAS allows web developers to develop the security in their application independent of
the chosen JAAS implementation, by using a simple API that can be invoked to answer
security related questions such as “who is the currently logged in user” and “does this
user belong to a specific ‘role’”.
To get the name of the currently logged in user in a JSF application, the following
statement can be used:
FacesContext.getInstance().getExternalContext().getUserPrincipal().getName()
To determine whether a user is in a specific role, the following boolean statement can be
used:
FacesContext.getInstance().getExternalContext().isUserInRole("roleName");
10 - 2 Application Security JHeadstart Developer’s Guide