What is the `j2ee security model ?
Aj2ee security is based on the notion of an `authenticated session’. When the client (e.g., Web browser) makes contact with the application server, the user is given the opportunity to log in. If login is successful, the client remains associated with his login credentials for the rest of the session. The user’s identity is known as theprincipal, and that principle can be associated with one or moreroles. This session is called an `authenticated session’.The login process is typically controlled by the application server; it will provide, for example, a servlet which accepts the user credentials (typically and ID and password), and stores the principal in the session. The developer does not have to write this servlet, but has to know how to get access to it.Security is implemented jointly by the developer and the administrator. The developer identifies security roles required in the application (`view’, `edit’, `manage’,…) and writes the code so that only principals in the correct ro
