java - j_security_check and JAAS -

i have been given task of implementing login handler. detail handler captures username , password. going use jsp posted servlet. servlet carried out db lookup , validated user credentials. upon successful login redirected unsuccessful takes jsp , displays appropriate error messages.

however upon doing research discovered j_security_check , jaas , not sure use or whether @ all.

what benefits either , suitable task? ?

security composed of following aspects:

1. authentication
2. authorization
3. transport layer security - encryption

authentication: - consists of checking credentials of user; of times implemented through login mechanism. task of creating login page part of authentication.

authorization: - application resources need protected unauthorized access means when ever user requests protected resource, application need ensure user has appropriate access rights. done assign roles user , putting request filters verify access rights of user. part more critical , requires detailed design analysis. authenticating user not enough, need ensure protected resources not accessed users not authorized same.

transport layer security: - system architecture need ensure data being transfered on network doesnot fall hands of hackers or sniffers. ssl/tsl used achieving this

j2ee containers , frameworks spring security provide common functionalities each of security aspect.

what trying develop simple authentication mechanism. application security more demandind when comes access control i.e. authorization.

also security need scalable i.e. business needs changes integrating systems , security system should able adapt things single sign on (sso), ldap authentication etc.

though jaas , container security enough scaling there few restrictions same. example need depend on vendor specific configurations , adapters. application declare security needs in deployment descriptors , server administrators need configure security realms @ server end.

i recommend evaluate spring security (previously acegi security) framework. have been using same in many of our projects , found robust, customizable , easy implement. comes set of filters intercept request , provide access control. framework can used validate users against various user repositories such database, ladp servers, os security etc. extensible , can integrated sso servers. provides useful taglibraries controlling access parts within jsp pages. not framework provides method level security can imposed @ class level through spring aop framework