Using JSF inside enterprise applications

Question

Dear Community,
at the moment I put alot of effort in learning JSF, but on some questions I hardly find any information, so I hope maybe you could help me a bit. As the questions are probably not easy to answer within some sentences, I rather need you show me the right direction than giving me a comprehensive answer ;)
Anyway, I welcome any help.
1. If a JSF web application handles sensitive data (e.g. customer data), how can I secure the application so the data cannot be stolen? Is SSL recommended? If yes, are there practical samples how I can use it inside JSF applications?
2. Are there any samples how I can secure XML web services? I read alot about SAML, XMLencryption and WS-Security, but I lack practical samples.
3. In case alot of customers work with a JSF application at the same time, how do you handle load-balancing in case the application needs to be distributed on 2 servers? Is it a good idea to handle communication between two servers via webservices?
Thank you.

Answer 1

1. If a JSF web application handles sensitive data
(e.g. customer data), how can I secure the
application so the data cannot be stolen? Is SSL
recommended? If yes, are there practical samples how
I can use it inside JSF applications?Yes, you can just use https. This is not JSF specific, just webcontainer/applicationserver-specific. Check it's documentation.
2. Are there any samples how I can secure XML web
services? I read alot about SAML, XMLencryption and
WS-Security, but I lack practical samples.http://www.google.com/search?q=saml+tutorial provides enough samples tho.
3. In case alot of customers work with a JSF
application at the same time, how do you handle
load-balancing in case the application needs to be
distributed on 2 servers? This is webserver-specific. Inside JSF you don't need to worry about this.
Is it a good idea to handle
communication between two servers via webservices?Why should it be a bad idea anyway, you think?