Implemeting simple authentication with J2EE

Question

Hi All,
i am converting a .NET web app to Java.
The application is is a very simple one including registration page, login, logout , password recovery , etc..
Registration and login also have a captcha on the page.
The application also needs to create users and roles programmatically.
All info should be stored in a DB
I consider all these features to be basic enough that every web app will require them , but when researching J2EE approach to those , I am stumped by the lack of information and simple implementation mechanisms.
After reviewing the docs for JAAS , Glassfish , J2EE , I still have not figured out a simple way to implement an architecture that will provide me with the features and flexibility described above, except for developing everything from scratch.
can someone please recommend to me an approach or a technology (or a set of them), that will fulfill the java promise and allow me to avoid messing about with implementation and focus on the business logic.
Thanks,
Shay

Answer 1

Hi Kaupo,
ill repeat my findings for the benefit of other readers.
1) JAAS forces you to use specific entry points , for example J_Secuirty for form authentication this approach wont work for an Ajax.RIA application.
2) JAAS provides no programmatic control over authentication , and no support for authorization.
3)some app servers complement JAAS by adding their own API's for programmatic control , but that forces you to another learning curve , and their implementations are very basic at best. for example Glassfish cant handle cross component sessions if you use a programmatic login.
4) after writing numerous prototypes i also decided to stear clear from EJB , and stick with POJO, since EJB forces unnecessary complexity for very little benefit.
5) the funniest thing i ran into was all the commotion about Spring , which at its best behaves like ASP.Net 4 years ago.
yes i know that it plugs so many holes in the poor implementations that EJB provides , but i found that library to be overly complex , with benefits for simple web development , not so much for serious enterprise work , and definitely not for RIA/AJAX.
one thing for sure ,Spring marketing is stellar :) , my recommendation would be to avoid the hype.
6) Acegi was swallowed by Spring , and now if you want to use Acegi, you need to learn Spring .
Results:
my research led me to the Jsecuirty framework which i am now customizing for my own needs.
1) its pojo based
2) no need for all the noise that Spring generates .
3) the framework is dedicated to 2 specific aspects authentication and authorization , and doesn't try to solve world hunger on the way(a problem which seems to plagues many open source products, please forgive the sarcasm)
4) friendly dev team , which actually enjoys answering questions .
5) the project is live , and i believe it will stay so for a while.
6) proper documentation
Thanks
Shay
Edited by: shay1680 on Feb 27, 2009 7:11 AM