Authentification in JSF ?

Question

I'm developing a JEE application (JSF2 + richfaces+ Facelets + Tomcat). What's the best way to perform authentification ? Or should i make my own ?

Answer 1

Go for Spring Security

Here is how to integrate it with JSF

Edit:

http://ocpsoft.com/java/acegi-spring-security-jsf-login-page/

Answer 2

People usually pick between ( in no specific order) :

JAAS ( wich is Java/J2EE default security framework )
Spring Security
Custom Made Security

I never used Spring Security but the documentation is huge, i gave up trying that once because of time constraint. JAAS have the advantages of being simple and work out of the box with Tomcat.

I've seen custom security built on top of JAAS too.

What you really have to do is figure out what you will especifically need in your application and check wich frameworks suits your needs better.

Without knowing your business needs, if you only need Authentication (User login) i would say JAAS is the most simple way to go as is it not application intrusive and you wont need to add Spring dependencies if you are not already using it.

Answer 3

JBoss Seam integrates EJB 3, Facelets, JSF, and hibernate really nicely. Also provides validation of data and some security stuff too. If you use it for all its features, it is really sweet. If you try to pick and choose only certain things out of it, then it is still cool, but you have a few work arounds. But I've been impressed with what I've seen of Seam so far.