title: JSF authentication and authorization
body: <p>What is the best way to go about implementing authentication and authorization for a JSF web application? Preferrably I'd still want to use container-based security, as I need to call EJBs that require the principal.</p>
  
  <p>I realize form-based authentication is a major struggle with JSF, but can I perhaps use a PhaseListener or something similar together with programmatic logon to authenticate the user?</p>
  
  <p>Any other methods I should rather have a look at?</p>