Skip to content

Commit e2be185

Browse files
bbuerklebbuerkle
committed
Will review comments
1 parent d40b640 commit e2be185

5 files changed

Lines changed: 15 additions & 12 deletions

File tree

‎src/main/jbake/content/security-intro003a.adoc‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ prev=security-intro003.html
99
[[using-pluggable-providers]]
1010
Using Pluggable Providers
1111
-------------------------
12-
Java EE provides two specifications that define SPI interfaces for
12+
Java EE includes two specifications that define SPI interfaces for
1313
pluggable security providers, JSR-196 and JSR-375. These specifications are
1414
described in more detail in the following sections:
1515

@@ -26,9 +26,9 @@ which the sender of a message "secures" it, and the receiver "validates" it.
2626
The details of how messages are secured and validated are undefined by the model;
2727
support for securing and validating particular types of messages is provided by
2828
"auth modules" -- implementations of the JASPIC `ClientAuthModule` and
29-
`ServerAuthModule` interfaces that support particular protocols or message types,
29+
`ServerAuthModule` interfaces -- that support particular protocols or message types,
3030
and that plug in to the JASPIC framework. (Note that it is not necessary for a
31-
client and server to both use JASPIC as long as both sides process messages
31+
client and server to both use JASPIC, as long as both sides process messages
3232
correctly for a given protocol.)
3333

3434
JASPIC defines two "profiles" for integrating JASPIC auth modules into Java EE
@@ -41,16 +41,16 @@ In the case of the Servlet Container Profile, if a `ServerAuthModule` is configu
4141
for a given application context, then the modules's `validateRequest()` method must be
4242
invoked (and succeed) before authorizing access and calling the target servlet,
4343
and the module's `secureResponse()` method must be called before returning a response.
44-
Typically, the `ServerAuthModule` under the Servlet Container Profile looks for
45-
user credentials or tokens and uses them to authenticate the caller and establish
44+
Typically, a `ServerAuthModule` written for the Servlet Container Profile looks for
45+
user credentials or tokens in an incoming request, and then uses them to authenticate the caller and establish
4646
the caller's identity. A `ServerAuthModule` may also engage in a challenge/response
4747
protocol with the client, or negotiate with a third party to establish/verify the
4848
client's identity.
4949

5050
As with the Servlet Container Profile, the SOAP Profile requires that
5151
`validateRequest()` be called and succeed before proceeding to authorize access and
5252
perform any further processing of an incoming message, and that `secureResponse()`
53-
is called for the response (if any) before it is sent. In contrast to the Servlet
53+
is called for the response before it is sent. In contrast to the Servlet
5454
Container Profile, `validateRequest()` processing for SOAP messages typically involves
5555
verifying signatures on signed elements, decrypting encrypted elements, and/or
5656
establishing the identity of a SOAP actor based on a token included in the message,

‎src/main/jbake/content/security-intro005a.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ but it can also manage user account data itself.
2525
The `IdentityStore` interface is intended
2626
primarily for use by the `HttpAuthenticationMechanism` (also specified in the
2727
Java EE Security API), but can be used by other implementations such as a JASPIC
28-
`ServerAuthModule` or a container's built-in authentication mechanism. Using the
28+
`ServerAuthModule` or a container's built-in authentication mechanisms. Using the
2929
`HttpAuthenticationMechanism`
3030
and `IdentityStore` implementations, both built-in and custom, provides a significant
3131
advantage over the BASIC and FORM mechanisms

‎src/main/jbake/content/security-javaee002.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -383,7 +383,7 @@ information to make security decisions within the method itself.
383383
In general, security management should be enforced by the container in a
384384
manner that is transparent to the enterprise bean's business methods. This section
385385
describes the SecurityContext API and security-related methods of the EJBContext API.
386-
The newer SecurityContext API duplicates some functions of the EJBContext API,
386+
The newer SecurityContext API duplicates some functions of the EJBContext API
387387
because it is intended to provide a consistent API across containers.
388388
These security APIs should be used only in the
389389
less frequent situations in which the enterprise bean business methods

‎src/main/jbake/content/security-webtier002.adoc‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -286,13 +286,15 @@ following:
286286
Specifying Authentication Mechanisms
287287
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
288288

289+
This section describes built-in authentication mechanisms defined by
290+
the Servlet specification.
291+
289292
[width="100%",cols="100%",]
290293
|=======================================================================
291294
a|
292295
*Note*:
293296

294-
The following section describes built-in authentication mechanisms defined in
295-
the Servlet specification. An alternative way to perform user authentication, including BASIC
297+
An alternative way to perform user authentication, including BASIC
296298
and FORM authentication, is to use the `HttpAuthenticationMechanism`, specified by the
297299
Java EE Security API, and documented in
298300
link:security-api.html#using-the-java-ee-security-api[Chapter 53, "Using the Java EE Security API"].

‎src/main/jbake/content/security-webtier003.adoc‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -230,8 +230,9 @@ the specified web resource for the specified HTTP methods, as determined by
230230
the security constraints configured for the application.
231231
+
232232
The resource
233-
parameter is a `URLPatternSpec` that identifies an application-specific web
234-
resource. LINK TO JAVADOC???.
233+
parameter is an `URLPatternSpec`, as defined by the Java Authorization Contract
234+
for Containers 1.5 specification (`http://jcp.org/en/jsr/detail?id=115`), that
235+
identifies an application-specific web resource.
235236
+
236237
This method can be used to check access to resources in the current application
237238
only — it cannot be called cross-application, or cross-container, to check

0 commit comments

Comments
 (0)