Authentication in Java EE

Question

I am developing an app whose client will be Html5 + javascript (single-page-app) and the backend will be basically Jax-rs + cdi + nosql (glassfish & orientdb). In this scenario, I need help to clarify how to authenticate users.

The user data is in the orientdb database. I know I have to create an algorithm p/ connect in the bd and validate the user credentials, but for this I must create a custom Realm and a Loginmodule on its own?

Answer 1

On an application server like Glassfish or Jboss we could solve this using standard security mechanisms. All you need to do is create a Connection pool, one JDBC Realm and implement form authentication.

Form:

<form method="POST" action="j_security_check">
  <input type="text" name="j_username">
  <input type="password" name="j_password">
</form>

Example of web.xml

<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>jdbcRealm</realm-name>
    <form-login-config>
        <form-login-page>/login.xhtml</form-login-page>
        <form-error-page>/login.xhtml</form-error-page>
    </form-login-config>
</login-config>
<security-constraint>
    <web-resource-collection>
        <web-resource-name>Secure Pages</web-resource-name>
        <description/>
        <url-pattern>/admin/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>ADMINS</role-name>
    </auth-constraint>
</security-constraint> 

That said, this authentication model may not be enough. Frameworks such as Spring Security and Apache Shiro are commonly used in web applications to provide more complete and flexible authentication and authorization implementations.