What's the best way for a web app to handle logins and sessions?

Question

I'm deploying in JBoss, using JSF. As is often the case, I keep User information in an entity bean. My question is, what's the best way to handle this bean?
My inclination is to create a login page with a LoginBackingBean atached to it. When the user attempts to log in, it will see if there is a User entity bean that corresponds to the given name and password. If there is no User bean that matches, obviously we show an informative error screen.
But what happens if there is a valid user?
In the plain old Servlet world (without EJB / J2EE) I would just put the User object (it's an object, not an EJB) into the HttpSession, and I would create a Filter that would check for the presence of that User object, and I would map the filter to something like /members/*, and that would be it. I would use Hibernate to persist the User object, and there would also be a filter that creates a Hibernate session and stores it in the Request so that the User object would work and persist.
How do I do this within the J2EE / EJB world?
My first thought would be to just do the same thing. Install the User bean into the HttpSession, and create a filter and do all the same stuff. Is that the right way to do it? It would work pretty well with JSF because I could just access things in the normal JSF way: #{user.firstName} would find the "user" object in the HttpSession scope. So that's good.
One question that comes up from that is if the user makes some change to the User object that is in the Session scope, will the EJB automatically do the right thing and make those changes persistent? Is there anything else I need to do?
I'm new to the EJB world, but from what I can see so far, it seems like it's the best way to think about a web application.
Thanks

Answer 1

hi ,
i think the best way is to create java beans ,in that bean call your EJB ,
and check the validation over there.
and make that bean scope to session.
in each and everypage try to check the session ,if it is not valid then forward to your login page...
otherwise continue to give access to him like guest
Regards,
AfTaB