Java EE 7 Form based authentication -

i'm working on web application based on java ee 7, postgresql , application server glassfish 4. need implement form based authentication, , secure url knowing :

• the users , roles/groups (whatever called) stored in database.
• i wanted application "standard" possible (i.e using jsf , jpa, , no other framework spring, struts ...)

after research, found java ee provided standard authentication mechanism called jaspic. so, focused research on jaspic , read multiple stackoverflow q/a , articles written arjan tijms (it's impossible find stackoverflow q/a related java ee without 1 of answers or comments, him way) :

• http://arjan-tijms.blogspot.fr/2012/11/implementing-container-authentication.html
• http://arjan-tijms.blogspot.fr/2013/04/whats-new-in-java-ee-7s-authentication.html
• http://arjan-tijms.blogspot.fr/2014/03/implementing-container-authorization-in.html

my question : jaspic allow me need (form authentication + url restriction roles) , worth effort use ? mean : it's perhaps safer , easier use mechanism.

arjan tijms says whether or not using jaspic "a kind of chicken-and-egg problem" , if jaspic safe use (it doesn't create more problems solves), no matter amount of code need write, want "one of first chickens".

i'm using jaspic authentication, jaspic has 1 limitation need contend (if want things standard). you're limited having no dependencies outside of java ee 7 api. means access jdbc resources require driver not capability explicitly stated in standards.

in openid connect implementation used google secure store, presents me google login form. larger example of using jaspic though.

for yourself, can expose ejb global namespace , use initialcontext ejb. there'd code duplication in have copy ejb remote interface code in 2 places , ensure serialversionids same on both. ejb can used connect jpa resources authorization data.

use ejbs, because other 2 options may think of rest , soap exposing on web ports , require configuration prevent unauthorized access or require placed on different system.

a simple jaspic implementation created in case want learn http header jaspic module intended integration more complex systems siteminder.