We have seen enough theory on Authentication and Authorization. Now we will actually get our hands dirty trying it out for basic and digest authentication.

Steps to configure basic/digest authentication can be summarized as:

1. Define the type of authentication (here BASIC/DIGEST)

2. Define roles, users and create mapping between them

3. Define resource collections to which security should be applied

Authorization is the process of checking if a user is allowed to access a particular resource on the server. To identify the user, we need to first do authentication and hence authentication is the first step towards authorization.

Authorization may be done in different ways, including:

1. Programmatically controlling access to resources based on individual user’s credentials.

2. Assigning users into different groups called roles and assigning permissions based on the roles

Authentication is the process of verifying if the user, usually with a username and password. Once authenticated, we may call a user as an authenticated user or a logged in user.

Java EE provides four different ways to authenticate a user:

1. Basic Authentication

2. Digest Authentication

3. Form Authentication

4. SSL Certificates

Security is one of the most important aspects of almost all web applications.  There are many areas of concern like client and server machine security, transmission channel security, database security etc.

While most security concerns are the responsibility of server or network administrators, application developers should also be concerned about some of the aspects of security such as authentication, authorization, data integrity and confidentiality.

1. Authentication