JAAS, Securing J2EE Applications: Securing Web Components
Web applications must be developed with security in mind right from the start. Developers should plan for securing a web application with both the web server and the application server in mind. Securing a J2EE application can seem very complicated, however. This article, the first of two parts, explains how to secure J2EE web components.
/*Also set similar permissions for other files. They are not shown here*/
Now for some explanations. The first entry grants the relevant permissions to the userLoginModule. The userLoginModule is considered fully trusted. So it is granted all permissions. The second entry grants permission to the program itself, since the application is not fully trusted. Hence subject is authenticated first, and Subject.doAs is invoked with that subject and a userAction, which accesses the System property- java.home, user, home and the file tips.html. Now for user_jaas.conf.
In this provide the application name and the required parameters. Here the name is given as userend.
userLoginModule required debug=true
5. Configure the J2EE Application server
This step changes with each application server. So it is better to consult the documents provided by the vendor.