[Java EE][Security] - Understanding Security Realms - 1. Main Thought

Securing Containers

In Java EE, the component containers are responsible for providing application security. A container provides two types of security: declarative and programmatic.

Container is responsible for security of components running inside. For example, the security model is running on application server layer, weblogic e.g., is not in application or compoent.

Realm, Users, Groups, and Roles

• A realm is a security policy domain defined for a web or application server. It's a collection of users, who may or may not be assigned to a group.
• A user is an individual or application program identity that has been defined in web or application server.
• A group is a set of authenticated users, classified by common traits, defined in web or application server.
• A role is an abstract name for the permission to access a particular set of resources in an application.

Mapping Roles to Users and Groups

Logic Relationship