title: Java EE Security: JASPIC / JAAS or apply a Security Framework? (Glassfish 3)
body: <p>I am currently using Oracle ADF (which is an end-to-end Java EE framework) for building my web applications and GlassFish 3.1 as application server.</p>
  
  <p>The latter supports <a href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/jaas/JAASRefGuide.html" rel="noreferrer">JAAS</a> (declarative inside its admin console). So, I have created a security realm and mapped them with the roles declared in a configuration file and use JAAS to implement the authorization and authentication security features.
  Everything fine, until now! This past weeks I have been researching on Java EE security. </p>
  
  <p>What I've found is that JAAS is good enough if you stick with <em>"basic"</em> security. Moreover, it seems that JAAS (as part of the Java Security Framework) was meant just for Java SE (but since Java EE is built on Java SE, some of it’s modules are being reused, such as LoginMethod and Callbacks).</p>
  
  <p>Then, I've found many posts about <a href="http://docs.oracle.com/cd/E19226-01/820-7627/girgp/index.html" rel="noreferrer">JASPIC</a>, finding out that it can be implemented only by a programmatic manner (not a problem) and it's not yet fully supported by app servers vendors, and tried to make a <a href="http://arjan-tijms.blogspot.com/2012/11/implementing-container-authentication.html" rel="noreferrer">comparison</a> between both. Even if <a href="http://arjan-tijms.blogspot.fr/2013/04/whats-new-in-java-ee-7s-authentication.html" rel="noreferrer">JASPIC1.1</a> release had resolved some issues, like: </p>
  
  <blockquote>
    <p>The container will however not fully remember the authentication. The
    SAM is still called at each request, and the SAM still has to
    re-authenticate</p>
  </blockquote>
  
  <p>(it doesn't sound so good to me).</p>
  
  <p>Then, I've passed on looking for <a href="http://code4reference.com/2013/08/guest-posttop-java-security-frameworks-for-developing-defensive-java-applications/" rel="noreferrer">integrating some security framework</a>. The most famous ones seems to be <strong><em>"Spring"</em></strong> and <strong><em>"Shiro"</em></strong>. Of course each one of them has it's own characteristics (may be the first is more suitable on a specific situation while the second in another). What's more important to me at the more are: </p>
  
  <ul>
  <li>Authentication</li>
  <li>Authorization</li>
  <li>Session Management (and possibly, encryption)</li>
  </ul>
  
  <p>But, everywhere I found contradictory conclusions. The result: I'm more confused now then before searching.</p>
  
  <p>I am just a novice in topics like security, and moreover I am a developer (I have stuff to implement), so it's kinda hard to keep up to date with every new release and the progress on security seems to keep going on every day galloping.</p>
  
  <p>I'd like some facts based on personal experience if possible. Every hint or suggestion is appreciated. I want to be sure I'm confident before taking the implementation step.</p>