Preface

The purpose of this book is to illustrate the applicability of Java 2 Platform, Enterprise Edition (J2EE), and Java 2 Platform, Standard Edition (J2SE), security technologies in building a secure enterprise infrastructure containing Java-based enterprise applications. With a pragmatic approach, the book explains why Java security is a key factor in an e-business environment and how application developers can use this technology in building secure enterprise applications.

The book introduces the J2EE and J2SE security architectures, showing how these architectures relate to each other and how they are augmented by Java Authentication and Authorization Service (JAAS) to provide authentication and authorization. Then, the book delves into the J2EE security technologies: The security aspects of servlets, JavaServer Pages (JSP), and Enterprise JavaBeans (EJB) are treated in detail because these technologies constitute the core of the J2EE architecture. To satisfy the needs of developers who need to build J2EE applications and want to do so securely and reliably, the book covers in great detail the relationship between J2EE and cryptographic technologies; Java Cryptography Architecture, Java Cryptography Extension, Public-Key Cryptography Standards, Secure/Multipurpose Internet Mail Extensions, and Java Secure Socket Extension are also described in detail. The book explains how to work with J2EE in practice and shows how the technologies presented work together and are integrated. The scenarios described are targeted to J2EE developers and deployers needing to build an integrated, secure, component-based system. Finally, Web Services security and other emerging technologies are discussed, along with a description of how the underlying middleware works. The book ends by summarizing the impact of J2EE security in today's e-business environments.

Unlike other treatments of Java security, this book discusses the J2SE and J2EE security architectures, providing practical solutions and use patterns to address the challenges that lie ahead as these architectures evolve to address enterprise e-business needs. The goal is to give practical guidance to groups involved in making Java-based applications or Web sites into industrial-strength commercial propositions . Examples are provided to give the reader a clearer understanding of the underlying technology.

To achieve the goals of portability and reusability, J2EE security has been designed to be mainly declarative. Most of the authentication, authorization, integrity, confidentiality, and access-control decisions on a J2EE platform can be made through configuration files and deployment descriptors, which are external to the applications. This reduces the burden on the programmer and allows Java enterprise programs to be portable, reusable, and flexible. For this reason, Parts I and II focus on the declarative approach of Java security by showing examples of configuration files and deployment descriptors. Additionally, these parts of the book explain how to use the programmatic approach if declarative security alone is insufficient. (Sample programs can be found in Chapters 4 and 5.) The majority of the sample code of this book can be found in Parts III and IV.

This book has its roots in several articles we wrote for the IBM Systems Journal and IBM developerWorks , describing the origins of Java security and the security for enterprise applications using the J2EE programming model. Although we are geographically dispersed around the United States, we had gathered in Santa Clara, California, at the O'Reilly Conference on Java in March 2000 to present on a number of security topics. It was clear that developers and managers were not familiar with Java security features, J2EE security, and how to manage security in a J2EE environment. Inquiries on Java and J2EE security were being routed to us via e-mail and through our colleagues. We had already written a book on J2SE security, but a book on security for enterprise applications, including those written for server-based applications and Web Services, was needed.

This book draws and expands on material from multiple sources, including the J2SE security book and articles mentioned. Specifically, this book covers J2SE V1.4 and J2EE V1.4. The relevant specifications for J2EE covered in this book include the J2EE V1.4 specification, the Java Servlet V2.4 specification, the EJB V2.1 specification, and the Web Services specifications. The list of the sources used in this book can be found in Appendix D.