Win a copy of Re-engineering Legacy Software this week in the Refactoring forum
or Docker in Action in the Cloud/Virtualization forum!
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic

Authentication, where?

 
Dennis Zandvliet
Ranch Hand
Posts: 60
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
What's the difference between authenticating like this in you're code

dataSource.getConnection(userName, password);

Or doing authentication by configuring in the datasource

Component-managed authentication with JAAS - J2C authentication data

Is there a performance issue?

 
Paul Sturrock
Bartender
Posts: 10336
Eclipse IDE Hibernate Java
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
The difference is one is in code the other is declarative.

My experience suggests some of the datasource implementations out there (I'm looking at you WebSphere) will not use the user name and password passed via the getConnection method.
 
Dennis Zandvliet
Ranch Hand
Posts: 60
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Paul Sturrock wrote:The difference is one is in code the other is declarative.

My experience suggests some of the datasource implementations out there (I'm looking at you WebSphere) will not use the user name and password passed via the getConnection method.


But what is the difference in practice? Is their performance difference?

Paul Sturrock wrote:

My experience suggests some of the datasource implementations out there (I'm looking at you WebSphere) will not use the user name and password passed via the getConnection method.


How will it then authenticate against the database?
 
Paul Sturrock
Bartender
Posts: 10336
Eclipse IDE Hibernate Java
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator

But what is the difference in practice? Is their performance difference?

I can't say categorically, but I'd guess no. Why should it perform any better than the existing datasource connection method?


How will it then authenticate against the database?

This is already configured in the DataSource. Why authenticate again?
 
Jeanne Boyarsky
author & internet detective
Marshal
Posts: 34084
337
Eclipse IDE Java VI Editor
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Dennis Zandvliet wrote:But what is the difference in practice?

Security. If you configure the password via the datasource, it doesn't need to be in the source code or a property file. This also prevents the developers from having to know the password. The server team can set it.
 
Dennis Zandvliet
Ranch Hand
Posts: 60
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Paul Sturrock wrote:
I can't say categorically, but I'd guess no. Why should it perform any better than the existing datasource connection method?


Because maybe, depending on how the driver has been implemented, for each call it re-authenticates the 'user'.

Paul Sturrock wrote:
This is already configured in the DataSource. Why authenticate again?


I mean when it's not yet configured in the Datasource.
 
Dennis Zandvliet
Ranch Hand
Posts: 60
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Jeanne Boyarsky wrote:
Dennis Zandvliet wrote:But what is the difference in practice?

Security. If you configure the password via the datasource, it doesn't need to be in the source code or a property file. This also prevents the developers from having to know the password. The server team can set it.


That's the only difference in practice?
 
Jeanne Boyarsky
author & internet detective
Marshal
Posts: 34084
337
Eclipse IDE Java VI Editor
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Dennis Zandvliet wrote:That's the only difference in practice?

I don't know. That such a big difference that hard coding the password was never an option where I work. Which wouldn't expose me to any other limitations.
 
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic