No, application managed security means an application context specific security aspect. If you want it hard coded in a class file the aspect uses a classloader. Same for a properties file. The point is, there is no reason why application managed security means that the username and password have to be passed to the jca provided connection factory getConnection call. If it is available because some user passed it in, fine, but it is not how server frameworks should be coded.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4009619#4009619
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4009619
How authentication fits into javaee was the subject of jsr196 (Java Authentication SPI
for Containers). It was not integrated into javaee 5 though. Your never going to have a standard properties file, or xml file for this info. There is an extension to the JAAS Configuration object that will have provider specific stores. All of our containers need to move to supporting this type of security aspect.
The getX(username, password) of api is broken as it exposes security as an api with a non-extensible representation of identity and proof of identity rather than an aspect that can be configured for the operation environment.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4009591#4009591
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4009591