GlassFish Security

More Information
  • Develop secure Java EE applications including Web, EJB, and Application client modules.
  • Reuse the security assets you have by learning GlassFish security realms in great details along with the sample for each realm.
  • Secure GlassFish installation including operating system security and JVM policy configuration.
  • Secure Java EE applications using OpenSSO and set up Single Sign-On (SSO) between multiple applications.
  • Secure web services using Java EE built-in features, OpenSSO and WS-Security.
  • Secure network listeners and passwords using GlassFish provided facilities.
  • Learn using OpenSSO services, SDKs, and agents to secure Java EE enterprise applications including Web Services.
  • Learn using OpenDS both as administrator and as an LDAP solution developer.
  • All command lines and more than 90% of the book content applies for both GlassFish 3.x and 2.x.

Security was, is, and will be one of the most important aspects of Enterprise Applications and one of the most challenging areas for architects, developers, and administrators. It is mandatory for Java EE application developers to secure their enterprise applications using Glassfish security features.

Learn to secure Java EE artifacts (like Servlets and EJB methods), configure and use GlassFish JAAS modules, and establish environment and network security using this practical guide filled with examples. One of the things you will love about this book is that it covers the advantages of protecting application servers and web service providers using OpenSSO.

The book starts by introducing Java EE security in Web, EJB, and Application Client modules. Then it introduces the Security Realms provided in GlassFish, which developers and administrators can use to complete the authentication and authorization setup. In the next step, we develop a completely secure Java EE application with Web, EJB, and Application Client modules.

The next part includes a detailed and practical guide to setting up, configuring, and extending GlassFish security. This part covers everything an administrator needs to know about GlassFish security, starting from installation and operating environment security, listeners and password security, through policy enforcement, to auditing and developing new auditing modules.

Before starting the third major part of the book, we have a chapter on OpenDS discussing how to install, and administrate OpenDS. The chapter covers importing and exporting data, setting up replications, backup and recovery and finally developing LDAP based solutions using OpenDS and Java.

Finally the third part starts by introducing OpenSSO and continues with guiding you through OpenSSO features, installation, configuration and how you can use it to secure Java EE applications in general and web services in particular. Identity Federation and SSO are discussed in the last chapter of the book along with a working sample.

  • Secure your GlassFish installation and J2EE applications
  • Develop secure Java EE applications including Web, EJB, and Application Client modules
  • Secure web services using GlassFish and OpenSSO web service security features
  • Support SSL in GlassFish including Mutual Authentication and Certificate Realm with this practical guide
Page Count 296
Course Length 8 hours 52 minutes
ISBN 9781847199386
Date Of Publication 10 May 2010


Masoud Kalali

Masoud Kalali is a Consulting Member of Technical Staff at Oracle. He is the author of Developing RESTful Services with JAX-RS 2.0, WebSockets, and JSON published in 2013 and GlassFish Security books published in 2010. He is the author of numerous articles and quick references from Java.Net to Dzone.

Since 2001, when he started working in different software development roles, he has been blessed enough to work on multiple loosely coupled architecture for high throughput message-based systems with JMS at heart and the rest of the components forming the stops around the JMS as the main messaging bus.

Performance analysis and performance consulting on architecture, design, code, and deployment configuration is another challenge he has spent some time working on.

RESTful services and use of RESTful endpoints for data integration is one of the other practices he worked on for data integration for industry leading software systems, IJC and TIBCO Spotfire, during his work at ChemAxon.

Masoud has worked on security integration as another area, specifically in integration OpenSSO with a solid SOA framework used for developing BPEL flow oriented software

At his current position at ORACLE he works as the lead engineer in the design and development of application server and PaaS infrastructure of the ORACLE cloud service on top of both OVM/OVAB and Nimbula virtualization providers.

Masoud’s Twitter handle is @MasoudKalali if you want to know what he is up to.