4

Given these techonologies: Java, JAX-RS (either RESTEasy og Jersey), Javascript and jQuery. The servlet server is either Tomcat or Jetty. The GUI will be made as an "application" using jQuery and Javascript. MVC or MVP patterns will be used to separate view from model. The plan is to load the application after login. I need some recommendation on how to make a secure login and manage access (roles). So far I know about SSL, encryption, Security Annotations (to guard methods) - but still, I need some overview and tips. So far my plan is to start reading the Java SE documentation at:

http://www.oracle.com/technetwork/java/javase/tech/index-jsp-136007.html#overview

Some input would be appreciated.

TacticalCoder
  • 6,275
  • 3
  • 31
  • 39
user669857
  • 273
  • 4
  • 14
  • It is a good thing that you sought after a JAAS framework / library instead of what i mostly see people do - rolling out their own "security" features. – Oh Chin Boon Mar 25 '12 at 16:46
  • Related question.. http://stackoverflow.com/questions/9678959/how-to-secure-my-java-web-applicationstion – aravindaM Mar 25 '12 at 17:07

2 Answers2

6

Apache Shiro for JAAS - http://shiro.apache.org/

Oh Chin Boon
  • 23,028
  • 51
  • 143
  • 215
2

I'd recommend taking a look at the Spring Security library. It is highly customizable, documented well, and often used and discussed on the web. You may have heard of it before under its old name, Acegi.

Kaleb Brasee
  • 51,193
  • 8
  • 108
  • 113