WebLogic provides several ways to secure a web application:
You can declaratively configure web authentication for clients that access your web application. You can restrict access to resources in a web application by applying security constraints to a collection of web resources.
A servlet/JSP can programmatically check whether the client has sufficient privileges before executing a particular piece of code.
You can programmatically log in a user, bypassing the standard J2EE mechanisms.
login-config element in the standard
web.xml deployment descriptor allows you to set
up authentication for a web application. You can specify the
authentication method using the
element. WebLogic supports the following authentication methods:
Here the web server authenticates the client against the security realm using the supplied username and password combination.
Here the client authenticates using a custom HTML form, which resembles:
<form method="post" action="j_security_check"> <input type="text" name="j_username"> <input type="password" name="j_password"> </form>
If you choose form-based
authentication, you must specify the locations for the login page
that initially will be displayed, and the error page that will be
used when the user fails to authenticate himself. Use the
form-login-page subelement to specify the login
page, and the
form-error-page subelement to specify ...