It's not an either-or proposition - both can be used together. JAAS is a much more comprehensive authentication/authorization solution, which consequently is more difficult to set up and has a stepper learning curve.
Thanks for the reply. But are there any pointers where we can find a comparison study of the same?
Also I am unable to do URL authorization using JAAS. I just didn't find anything comprehensive on the net(apart from the tutorial from www.moore.com).
Thats the reason why I wanted to compare JAAS and j_security_check(for evaluation).
Also the project which I am working on currently, would be deployed on GlassFish v2(I have no idea of GlassFish... I am new to it)
Thanks for the Info.
Joined: Mar 22, 2005
Correct, JAAS is not web app-specific, and so it has no mechanism to be mapped to URLs. That's where the jGuard project I pointed you to comes in handy.
You can't really compare JASS and web app security, as they are targeted towards different scenarios. Generally, you only need to use JAAS if the username/role concept provided by web app security is not sufficient. For many web apps, it is sufficient.
It should also be pointed out that often people do not use web app security, but rather develop their own, because what web app security provides is rather limited. But in those cases, too, JAAS is not often used due to its complexity.
Joined: Jul 24, 2008
I am not supposed to use JGuard in my project. My client really doesn't want to use open source software in the project. So I stuck to JAAS because I had 3 fields(key, username and password) for authentication.
I somehow managed to get it to work. Thanks for the pointers.