Using JAAS with Tomcat
Want to use JAAS with Tomcat? If so, you might want to checkout this Using Tomcat with JAAS tutorial.
Although it is possible to use JAAS within Tomcat as an
authentication mechanism (JAASRealm), the flexibility of the JAAS
framework is lost once the user is authenticated. This is because the
principals are used to denote the concepts of "user" and "role", and
are no longer available in the security context in which the webapp is
executed. The result of the authentication is available only through request.getRemoteUser() and request.isUserInRole().
This reduces the JAAS framework for authorization purposes to a
simple user/role system that loses its connection with the Java
Security Policy. This tutorial's purpose is to put a full-blown JAAS
authorisation implementation in place, using a few tricks to deal with
some of Tomcat's idiosyncrasies.
Personally, request.isUserInRole() usually does everything I need. If I need something more than that, it's usually pretty easy to add some custom logic. Of course, if I ever need anything super robust, I'll probably use the Acegi Security System for Spring.