WebSphere Application Server - IBM Redbooks

}
// get the principal from the request
Principal principal=req.getUserPrincipal();
// print out the user information about the servlet invocation
System.out.println("Transfer Servlet was invoked by user:
"+req.getRemoteUser()+", principal: "+principal.getName());
16.5 JAAS security
Java Authentication and Authorization Services (JAAS) is an alternative to the
built-in security support in WebSphere allowing programmatic authentication and
authorization to be used within an application. It is a standard extension to the
Java 2 SDK Version 1.3 and it is part of Java 2 SDK Version 1.4. The current
version for JAAS is 1.0.
To illustrated this type of security, let us take an example from the Online Catalog
sample. As supplied with this publication, the sample uses two different methods
of authenticating to the SALESAPP database.
In the first method, the user ID and password required to access the database
are coded within the Web module. The JSPs generated by the Database Web
Pages wizard use this method. The wizard registers each JSP as a servlet in the
Web deployment descriptor and defines three initialization parameters to hold
values for accessing the database: The data source name, the user ID, and
password.
When the JSP connects to the database, the user ID and password are retrieved
from the initialization parameters and used by the jspsql taglib to authenticate to
the database. This method is a little awkward in larger applications because
every JSP that accesses the database need to have the user name and
password initialization parameters defined in the deployment descriptor. The
wizard does this for you automatically, but if you ever need to change the values
you have to update every servlet. Secondly, the password is stored in the clear.
In the second method, JAAS security is used for authentication. This is shown in
Figure 16-12 on page 571. In this case, you do not supply the user ID or
password for database authentication in the application. They are stored under
an alias in the server configuration, and a pointer to that alias is put in the data
source. Whenever the database is accessed, the user ID and password
information in the alias is used for authentication. The advantage is that the user
ID and password are stored in one place and the password is encrypted.
570 IBM WebSphere Application Server - Express V5.0.2 Developer Handbook