title: How to handle authentication/authorization with users in a database?
body: <p>Currently, I am working on a web project using JSF 2.0, Tomcat 7 and MongoDB. I have a big question of how to handle the session management and authentication/authorization with users in a database.</p>
  
  <p>The structure I want is as follows: only logged in users can create events and everyone can see the created events. </p>
  
  <ul>
  <li><code>create.xhtml</code> --> only for logged in users.</li>
  <li><code>events.xhtml</code> --> public for everyone.</li>
  </ul>
  
  <p>The basic structure I'm planning is:</p>
  
  <ul>
  <li>Check if the page requires logged in user (e.g. <code>create.xhtml</code>)</li>
  <li>If yes, check if user is logged in</li>
  <li>If user is not logged in, go to <code>login.xhtml</code></li>
  <li>If successfully logged in, come back to requested page</li>
  <li>Keep the "User is logged in" information unless user clicks log out
  button. (there I guess <code>@SessionScoped</code> gets into play)</li>
  </ul>
  
  <p>The question is:</p>
  
  <ol>
  <li>What is the less complicated way of doing this?</li>
  <li>Where should I use the <code>@SessionScoped</code> annotation? In <code>Create.java</code> or
  <code>LoginManager.java</code>?</li>
  <li>Spring security looks kind of complicated for my issue, do I really
  need it? if yes, can you explain a little bit of how the implementation works together with JSF 2.0 and Mongo DB?</li>
  </ol>