Overview
Authentication is mandatory for many application. The authentication is the
base of the autorisation mechanism and can be used by the EJB developper to know
the identity of the caller.
The identity is retrieved by calling on the EJB context:
String name = _ejbContext.getCallerPrincipal().getName();
The authentication in the Remoting component is based on the servlet authentication.
The J2EE specification says that the identy used for a servlet access must be
propagated to the EJB container.
The Remoting uses 2 deployments of the HttpSessionServer servlet. One unauthenticated
(/httpSession) and the other authenticated (/authenticatedHttpSession).
The mechanism is completely transparent for the user. If the HttpSessionClient has
both login and password it automaticaly makes the call on the /authenticatedHttpSession.
Beetween the 3 ways of transmitting the identity from a web client to a server,
we have chosen the simplest one : the http basic authentication.
The login and the password are send in the HTTP header after a simple base 64 encoding.
The encoding relies on the apache jakarta commons-codec library.