Reviewing Security Concepts

If you read Working with Realms, Users, Groups, and Roles, you will remember the following information:

• On the Enterprise Server, the following concepts need to be understood in order to work with security roles.

  • A realm is a complete database of users and groups that identify valid users of a web application (or a set of web applications) and are controlled by the same authentication policy. For more information, read What Is a Realm?.

  • A user is an individual (or application program) identity that has been defined in the Enterprise Server. On the Enterprise Server, a user generally has a user name, a password, and, optionally, a list of groups to which this user has been assigned. For more information, read What Is a User?.

  • A group is a set of authenticated users, classified by common traits, defined in the Enterprise Server. For more information, read What Is a Group?.

  • A principal is an entity that can be authenticated by an authentication protocol in a security service that is deployed in an enterprise.

    For more information on configuring users on the Enterprise Server, read Managing Users and Groups on the Enterprise Server.

• During deployment, the deployer takes the information provided in the application deployment descriptor and maps the roles specified for the application to users and groups defined on the server using the Enterprise Server deployment descriptors sun-web.xml, sun-ejb-jar.xml, or sun-application.xml.

  For more information, read Mapping Security Roles to Enterprise Server Groups.

• The concepts of users, groups, principals, and realms exist in most application or web servers, but might use different names in different products. If you are using a server other than Enterprise Server, consult your product's documentation for the terminology specific to that server.