J2EE SDK Security Options?

Question

I hope someone can advise here. Even better, I hope someone can point to some sample code. Fundamentally, all I want to do is log in to my web application.
The kicker is that I want the person that logs in to be propagated back to the application tier.
Simply put, Servlet containers have a security layer, and I can do this:
Principal p = httpServletRequest.getUserPrincipal();
and
if (httpServletRequest.isUserInRole("MYROLE") { ... }
On the EJB side I can do this in, say, a Session Bean:
Principal p = sessionContext.getCallerPrincipal();
and
if (sessionContext.isCallerInRole("MYROLE") { ... }
So, what do I need to do to enable Container managed security in a WAR so that both my Servlets and SessionBeans will get the same Principals when they call their respective methods?
On the surface you'd like to think this would be easy being all part of the happy integrated J2EE family, but it doesn't seem that way.
I'm looking specifically for the J2EE SDK, SJAS 8.2, as this appears very platform dependent.

Answer 1

There are 2 other ways you can login to Sun Java System Application Server
1) using system properties j2eelogin.name and j2eelogin.password
System.setProperty("j2eelogin.name", usr);
     System.setProperty("j2eelogin.password", pwd);
2) sun-acc.xml (if you are running application client)
see the following URL for more details
http://docs.sun.com/source/817-6087/dgacc.html#wp1010634
I`m using the Sun Java System Application Server
Platform Edition 8 to develop some ejb. I`m connecting
from a remote client. I`ts all working just fine but
my client needs to be able to login an logout from the
server. One way to do this seems to be using
programmatic login as described here
http://docs.sun.com/source/817-6087/dgsecure.html#wp257
0 , but it doesnt seems to be an elegant solution.
Is there someone who can tell me how to get a
handle to the JAAS login context?
The security manager doesnt allow to instantiate one
(i`ve looked in the policy file). And if i use the
JAAS in the normal way I only get to implement the
CallbackHandler. It would have been all so nice if i
would just create a logincontext!