We have seen that there are two aspects to Java EE container security: authentication and authorization. Authentication is the process of verifying that users are who they claim to be. Authorization is the process of restricting operations to specific users or categories of users. The Java EE security model deals with principals, roles and realms. A principal is an entity that we wish to authenticate. A role is a logical grouping of principals. A realm is the scope over which a common security policy applies.

Defining principals, roles, and realms is application server specific; we saw how to do this for GlassFish.

We saw how to configure the GlassFish application client container to authenticate an EJB application client.

There are two kinds of EJB authorization mechanisms: declarative and programmatic. With declarative authorization, security is managed by the container. The EJB specifies the desired access control using annotations. With programmatic authorization, the EJB controls...