GlassFish Security: Secure your GlassFish installation, Web applications, EJB applications, application client module, and Web Services using Java EE and GlassFish security measures

296 Pages·2010·4.9 MB·English

by  Masoud Kalali

GlassFish Security
Secure your GlassFish installation, Web applications,
EJB applications, application client module, and
Web Services using Java EE and GlassFish
security measures
Masoud Kalali
BIRMINGHAM - MUMBAI
GlassFish Security
Copyright © 2010 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval
system, or transmitted in any form or by any means, without the prior written
permission of the publisher, except in the case of brief quotations embedded in
critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy
of the information presented. However, the information contained in this book is
sold without warranty, either express or implied. Neither the author, nor Packt
Publishing, and its dealers and distributors will be held liable for any damages
caused or alleged to be caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the
companies and products mentioned in this book by the appropriate use of capitals.
However, Packt Publishing cannot guarantee the accuracy of this information.
First published: May 2010
Production Reference: 1030510
Published by Packt Publishing Ltd.
32 Lincoln Road
Olton
Birmingham, B27 6PA, UK.
ISBN 978-1-847199-38-6
www.packtpub.com
Cover Image by Karl Swedberg ([email protected])
Credits
Author Editorial Team Leader
Masoud Kalali Gagandeep Singh
Reviewers Project Team Leader
Arun Gupta Lata Basantani
Gaston C. Hillar
Kumar Jayanti Project Coordinator
Joel Goveya
Ludovic Poitou
Antonio Gomes Rodrigues
Proofreader
Emmanuel Venisse
Lynda Sliwoski
Deepak Vohra
Indexer
Acquisition Editor Monica AAjjmmeerraa MMeehhttaa
Rashmi Phadnis
Graphics
Development Editor Geetanjali Sawant
Reshma Sundaresan
Production Coordinator
Technical Editor Shantanu Zagade
Vinodhan Nair
Cover Work
Copy Editor Shantanu Zagade
Sanchari Mukherjee
About the Author
Masoud Kalali has a software engineering degree and has been working on
software development projects since 1998. He has experience with a variety of
technologies (.NET, J2EE, CORBA, and COM+) on diverse platforms (Solaris, Linux,
and Windows). His experience is in software architecture, design, and server-side
development.
Masoud has several articles published in Java.net and DZone, and has authored
multiple refcards published by DZone, including Java EE security and GlassFish
v3 refcards. He is one of founder members of the NetBeans Dream Team and a
GlassFish community spotlighted developer.
Masoud's main areas of research and interest include Service Oriented Architecture
and large-scale systems' development and deployment. In his leisure time he enjoys
photography, mountaineering and camping.
Masoud blogs on Java EE, Software Architecture and Security at
http://weblogs.java.net/blog/kalali/ and you can follow him at
his Twitter account at http://twitter.com/MasoudKalali.
Masoud can be reached via [email protected] in case you had some queries about
the book or if you just felt like talking to him about software engineering.
About the Reviewers
Gastón C. Hillar has been working with computers since he was eight. He
began programming with the legendary Texas TI-99/4A and Commodore 64 home
computers in the early 80s.
He has a Bachelor's degree in Computer Science, graduated with honors, and an
MBA (Master in Business Administration), graduated with an outstanding thesis.
He has worked as developer, architect, and project manager for many companies
in Buenos Aires, Argentina. He was project manager in one of the most important
mortgage loan banks in Latin America for several years. Now, he is an independent
IT consultant working for several American, European, and Latin American
companies, and a freelance author. He is always looking for new adventures
around the world.
He also works with electronics (he is an electronics technician). He is always
researching and writing about new technologies. He owns an IT and electronics
laboratory with many servers, monitors, and measuring instruments.
He has written two books for Packt Publishing, C# 2008 and 2005 Threaded
Programming: Beginner's Guide and 3D Game Development with Microsoft Silverlight 3:
Beginner's Guide.
He contributes to Dr. Dobb's Go Parallel programming portal at
http://www.ddj.com/go-parallel/ and is a guest blogger at Intel
Software Network (http://software.intel.com).
In 2009, he was awarded as an Intel® Black Belt Software Developer.
Besides all this, he is the author of more than 40 books in Spanish about computer
science, modern hardware, programming, systems development, software
architecture, business applications, balanced scorecard applications, IT project
management, the Internet, and electronics, published by Editorial HASA and Grupo
Noriega Editores.
He usually writes articles for leading Spanish magazines Mundo Linux, Solo
Programadores, and Resistor.
He lives with his wife, Vanesa, and his son, Kevin. When not tinkering with
computers, he enjoys developing and playing with wireless virtual reality
devices and electronics toys with his father, his son, and his nephew Nico.
You can reach him at: [email protected].
You can follow him on Twitter at: http://twitter.com/gastonhillar.
Gastón's blog is at: http://csharpmulticore.blogspot.com.
Kumar Jayanti is a staff engineer at Sun Microsystems and works on the Web
Technologies and Standards team. In his current role, Kumar is the implementation
lead for GlassFish v3 Security, Metro Web Services Security, and also the
specification and implementation lead for the SAAJ (JSR 67). Kumar holds an
M.Tech degree in Computer Science from IIT Mumbai, India. His areas of interest
include distributed computing, CORBA, XML, Web Services, and Security.
Ludovic Poitou is a directory services architect at Sun Microsystems and the
community manager for the OpenDS project. For the past 15 years, he's been
designing and developing numerous aspects of Sun's directory products, from
management tools to protocols, security and multi-master replication.
Ludovic blogs about LDAP, directory services, OpenDS, and life at
http://blogs.sun.com/Ludo.
Ludovic Poitou has been a technical reviewer for the following books:
• Solaris and LDAP Naming Services: Deploying LDAP in the Enterprise,
by Tom Bialaski and Michael Haines, 2001, Sun Microsystems Press, a
Prentice Hall Title.
• LDAP in the Solaris Operating Environment: Deploying Secure Directory
Services, by Michael Haines and Tom Bialaski, 2004, Sun Microsystems
Press, a Prentice Hall Title.
Antonio Gomes Rodrigues earned his Masters degree from the University of
Paris VII in France. Since then, he has worked in various companies with Java EE
technologies in the roles of developers, technical leader, and technical manager
of offshore projects.
He currently works on performance problems in Java EE applications in a
specialized company.
I would like to thank my friend Nadère for his motivation and
support, my girlfriend Aurélie for her patience, and my family.
Emmanuel Venisse has been developing, architecturing, and integrating J2EE
applications for twelve years for banks, government, holiday company projects,
and so on. He's been working on several J2EE application servers such as JBoss,
WebLogic, WebSphere, and more recently with GlassFish. For the last five years, he
has worked as a freelancer. For the last seven years, he's been working, in his spare
time, on Apache Maven, Continuum, and Archiva projects as a core developer and
he's also the Continuum project leader. He has contributed to the majority of books
written about Apache Maven.
Deepak Vohra is a consultant and a principal member of the software company
NuBean.com. Deepak is a Sun Certified Java Programmer and Web Component
Developer, and has worked in the fields of XML and Java programming and J2EE for
over five years. Deepak is the co-author of the Apress book, Pro XML Development
with Java Technology and was the technical reviewer for the O'Reilly book
WebLogic: The Definitive Guide. Deepak was also the technical reviewer for the
Course Technology PTR book Ruby Programming for the Absolute Beginner, and
the technical editor for the Manning Publications book Prototype and Scriptaculous
in Action. Deepak is also the author of the Packt Publishing books JDBC 4.0 and
Oracle JDeveloper for J2EE Development, and Processing XML documents with Oracle
JDeveloper 11g.

To My Parents