Authentication is the process of verifying that the user is who he or she is claiming to be. This is typically done by asking the user to provide a username and password. Another way to verify the client identity is by asking for client certificates. In this chapter, we will look at password authentication only.
Authorization is the process of determining whether a user is allowed to perform certain actions in the application. The JEE specification allows role-based authorization. In the application, you specify roles that can perform an action, or access a resource, and then add users to these roles.
Unfortunately, securing JEE applications, as per JEE specifications, is not completely server-independent. There are parts of the configuration that are common across servers, and there are parts that are specific to server vendors. Common...
