Securing the Enterprise Server

This tutorial describes deployment to the Sun GlassFish Enterprise Server v3, which provides highly secure, interoperable, and distributed component computing based on the Java EE security model. The Enterprise Server supports the Java EE 6 security model. You can configure the Enterprise Server for the following purposes:

• Adding, deleting, or modifying authorized users. For more information on this topic, read Working with Realms, Users, Groups, and Roles.

• Configuring secure HTTP and IIOP listeners.

• Configuring secure Java Management Extensions (JMX) connectors.

• Adding, deleting, or modifying existing or custom realms.

  A discussion of this topic is available in Realm Configuration in Sun GlassFish Enterprise Server v3 Application Development Guide.

• Defining an interface for pluggable authorization providers using Java Authorization Contract for Containers (JACC).

  Java Authorization Contract for Containers (JACC) defines security contracts between the Enterprise Server and authorization policy modules. These contracts specify how the authorization providers are installed, configured, and used in access decisions. JACC is discussed in JACC Support in Sun GlassFish Enterprise Server v3 Application Development Guide.

• Using pluggable audit modules.

  A discussion of using pluggable audit modules can be found in Pluggable Audit Module Support in Sun GlassFish Enterprise Server v3 Application Development Guide

• Customizing authentication mechanisms

  All implementations of Java EE 6–compatible Servlet containers are required to support the Servlet Profile of JSR–196, which offers an avenue for customizing the authentication mechanism applied by the web container on behalf of one or more applications. Some discussion of using the JSR–196 contract to configure a custom container authentication mechanism is discussed in Adding Authentication Mechanisms to the Servlet Container in Sun GlassFish Enterprise Server v3 Application Development Guide.

• Setting and changing policy permissions for an application.

  You can read more about changing policy permissions in The server.policy File in Sun GlassFish Enterprise Server v3 Application Development Guide.

The following features are specific to the Enterprise Server:

• Message security

  Message security is discussed in Configuring Message Security for Web Services in Sun GlassFish Enterprise Server v3 Application Development Guide.

• Single sign-on across all Enterprise Server applications within a single security domain.

  You can learn more about single sign-on in User Authentication for Single Sign-on in Sun GlassFish Enterprise Server v3 Application Development Guide.

• Programmatic login

  You can learn more about programmatic login in Programmatic Login in Sun GlassFish Enterprise Server v3 Application Development Guide.

For more information about configuring the Enterprise Server, read the Sun GlassFish Enterprise Server v3 Application Development Guide and Sun GlassFish Enterprise Server v3 Administration Guide.