What Is a User

<< What Is a Realm | Managing Users and Groups >>

What Is a User

In the certificate realm, the server stores user credentials in a certificate database. When
using the certificate realm, the server uses certificates with the HTTPS protocol to
authenticate web clients. To verify the identity of a user in the certificate realm, the
authentication service verifies an X.509 certificate. For step-by-step instructions for creating
this type of certificate, see

"Working with Digital Certificates" on page 788

. The common name

field of the X.509 certificate is used as the principal name.

The admin-realm is also a FileRealm and stores administrator user credentials locally in a file
named admin-keyfile. You can use the Admin Console to manage users in this realm in the
same way you manage users in the file realm. For more information, see

"Managing Users and

Groups on the Application Server" on page 781

What Is a User?

A user is an individual (or application program) identity that has been defined in the
Application Server. In a web application, a user can have a set of roles associated with that
identity, which entitles them to access all resources protected by those roles. Users can be
associated with a group.

A Java EE user is similar to an operating system user. Typically, both types of users represent
people. However, these two types of users are not the same. The Java EE server authentication
service has no knowledge of the user name and password you provide when you log on to the
operating system. The Java EE server authentication service is not connected to the security
mechanism of the operating system. The two security services manage users that belong to
different realms.

What Is a Group?

A group is a set of authenticated users, classified by common traits, defined in the Application
Server.

A Java EE user of the file realm can belong to an Application Server group. (A user in the
certificate

realm cannot.) An Application Server group is a category of users classified by

common traits, such as job title or customer profile. For example, most customers of an
e-commerce application might belong to the CUSTOMER group, but the big spenders would
belong to the PREFERRED group. Categorizing users into groups makes it easier to control the
access of large numbers of users.

An Application Server group has a different scope from a role. An Application Server group is
designated for the entire Application Server, whereas a role is associated only with a specific
application in the Application Server.

What Is a Role?

A role is an abstract name for the permission to access a particular set of resources in an
application. A role can be compared to a key that can open a lock. Many people might have a
copy of the key. The lock doesn't care who you are, only that you have the right key.

Working with Realms, Users, Groups, and Roles

The Java EE 5 Tutorial · September 2007

780