Specifying Security Constraints
Specifying Security Constraints
the client and the container should be protected. If a user transport guarantee of
INTEGRAL or CONFIDENTIAL is declared, all user name and password information
will be sent over a secure connection using HTTP over SSL (HTTPS). Network security
requirements are discussed in
for access to web content, the realm in which the user will be authenticated, and, in the case
of form-based login, additional attributes. When specified, the user must be authenticated
before access to any resource that is constrained by a security constraint will be granted. The
types of user authentication methods that are supported include basic, form-based, digest,
and client certificate. Read
rather than in the deployment descriptor for the web application. Configuring security on the
Application Server is discussed in the following sections and books:
constraint is used to define access privileges to a collection of resources using their URL
mapping. Security constraints are defined in a deployment descriptor. The following example
shows a typical security constraint, including all of the elements of which it consists: