Architecting Modern Java EE Applications

Custom security

The following shows a more sophisticated example.

In order to provide custom authentication, application developers implement a custom HttpAuthenticationMechanism, especially the validateRequest() method. The class only has to be visible to the container as a CDI bean. The rest is done by the application container. This simplifies the security integration for developers.

The following shows a basic example, with pseudo code representing the actual authentication:

import javax.security.enterprise.AuthenticationException;import javax.security.enterprise.authentication.mechanism.http.*;import javax.security.enterprise.credential.UsernamePasswordCredential;import javax.security.enterprise.identitystore.CredentialValidationResult; ...