When an authenticated principal tries to access a resource, the system determines whether the principal is authorized to do so based on the security policies in force in the application's security policy domain . The following sections give an overview of J2EE platform security services. Security services are discussed in detail in Chapter 9 . Declarative security refers to the means of specifying an application's security structure in a form external to the application. An Application Component Provider specifies declarative security in a component's deployment descriptor.
Programmatic security refers to security mechanisms accessed within a program.
An Application Component Provider accesses programmatic security for EJB and Web components with J2EE platform security APIs. The J2EE platform allows an Application Component Provider to choose how a principal is authenticated. A Web client can provide authentication data to a Web container using HTTP basic authentication, digest authentication, form-based authentication, or certificate authentication. With basic authentication, the Web server authenticates a principal using the user name and password obtained from the Web client. Like basic authentication, digest authentication authenticates a user based on a user name and a password.