Securing JHeadStart Applications

Securing JHeadStart can be a tricky subject but following a few recent posts you can get this up and running smoothly. In order to get the best security services, you'll want to utilize declaritive J2EE using JAAS. This post will be covering using JDev 10.1.2 and OC4J 10.1.2.

First, you'll need to follow How To Add J2EE Authentication and Authorization to JHeadstart Applications. That will get you setup using the jazn-data.xml for the user's credentials. This works well, but more than likely if you are not using some type of LDAP server for security you are probably acquiring your credentials from a database table (like me). But, you will need to follow these steps to setup security so that it is enabled while you are working with your application in JDeveloper. You want your development environment to as close to the production enviornment as possible .

Once you have that configured, you'll be ready to deploy your app to OC4J. I'm using creditials authorized from a database table as oppposed to the jazn-data.xml file as the user's creditials are always being added, deleted and modified. In order to get this setup, you will want to read Declartive J2EE authentication and authorization with JAAS. It took me several times to get my app running using the login module as described in this paper. I highly recommend making sure you can get the example code working first and understand it before applying to your JHeadStart application.

Before I deploy my application to OC4J, there is one change I am having to make to my web.xml file. Open properties for web.xml and remove Realm from Login Configuration. I remove the text, deploy to OC4J, and then put the line back in there so that it runs in JDev.