Custom Security mechanism in Java EE 6/7 application

Question

I would like to create (implement by my own) authentication mechanism which will be plugged into my Java EE application.

As far as I know I have to implement LoginModule and connect this implementation with container mechanisms somehow. But the problem is that I don't know how to do it. Maybe You know where I can find sample code or tutorial about it?

In other words I would like to force container to call my classes whenever methods: authenticate, login, and logout are called.

Sample implementation: HttpServletRequest.login method will successfully authenticate only users with even numer of letters in login.

Answer 1

I believe the container independent way of doing this is to use JASPIC (JSR 196). Unfortunately it doesn't appear simple, robust, or particularly well documented. Here is a reference: http://arjan-tijms.blogspot.com/2012/11/implementing-container-authentication.html.