java - Simple login and logout capabilities for my web app(JSF 2.0) -

this morning rode chapters 39,40 , 41 of jee6 tutorial. very, confused. don't have background on web-app security jee6, , having big difficulties understand , implement.

i need create authorization mechanism web app, scenario not simple begginer in jee6 me decided try find easiest way it.

i thought explain idea, can correct me , give me advice on how best easiest way it.

idea:

my web app uses primefaces component called dock pops log in dialog when use clicks in last item. navigation tool located in jsf template used other pages in application.

    <h:body> <p:dock position="top">      <p:menuitem value="naslovna" icon="unsecuredimages/naslovna.png" url="main.xhtml"         alt="the image not found." />     <p:menuitem value="register" icon="unsecuredimages/register.png"         url="registration.xhtml" alt="the image not found." />     <p:menuitem value="cesta pitanja" icon="unsecuredimages/faq.png"         url="faq.xhtml" alt="the image not found." />         <!-- login not have page, pop login dialog -->     <p:menuitem value="login" icon="unsecuredimages/login.png" url="#" onclick="dlg.show()"/>        </p:dock> <p:dialog header="prijavite se" widgetvar="dlg"  modal="true" draggable="false" resizable="false" effect="slide">        <h:outputtext value="em@il:" /><h:inputtext id="email" value=""/>      <br/>        <h:outputtext value="lozinka:" /><h:inputtext id="password" value=""/>      <br/>       <h:commandbutton value="prijavi se" /> </p:dialog>          <br/><br/><br/><br/><br/><br/>   <ui:insert name="mainform" /> <ui:insert name="registrationform" /> <ui:insert name="registrationbuyerform" /> <ui:insert name="registrationsellerform" /> <ui:insert name="faqform" /> <ui:insert name="registrationsuccessform" />   </h:body> 

that jsf think should have backing bean handles email , password on ejb.

import javax.ejb.ejb; import javax.enterprise.context.sessionscoped; import javax.faces.bean.managedbean; import ejbinterfaces.iauthentificationejb; @managedbean @sessionscoped public class securitycontroller { @ejb private iauthentificationejb authentificationejb; private string email; private string password;  public void login() {     authentificationejb.saveuserstate(email, password); }  public string getemail() {     return email; }  public string getpassword() {     return password; }  public void setemail(string email) {     this.email = email; }  public void setpassword(string password) {     this.password = password; }    

}

then ejb should login , log out(this confused):

@stateful(name = "ejbs/authentificationejb") public class authentificationejb implements iauthentificationejb {       //login public boolean saveuserstate(string email,string password) {     //1-send query database see if user exist     //2-if query returns user object, store somewhere in session(how?)     //3-return true if user state saved     //4-return false otherwise     return false; }   //logout public void releaseuserstate() {     //1-check if there saved in session(or wherever state saved)     //2-if 1 flush }  //check if user logged in public boolean checkauthentificationstatus() {     //1-check if there saved in session(this means user logged in)     //2-if there not user loged, return false     return false; } 

}

i decided not use jdbc realm or other of authentification mechanisms explained in jee6 tutorial, because confused, think easier me manually. doubts have approach:

• is approach correct(can done way)?
• should ejb @stateless or @statefull in case(the user retrived database ony has 2 string fields)?

• where should store id of retrieved user database, last until user decides logout?

• if have store user state in session until he/she decides logout, how can it?

• with approach session user delated when closes browser without logging out(if no, how can expire his/her session automatically after while if there not activity?)

ill appreciate lot help.

some pieces of puzzle:

is approach correct(can done way)?

yes can. can choose between container managed security or application managed.

should ejb @stateless or @statefull in case(the user retrived database ony has 2 string fields)?

if store id of logged in user in session context (see below), think can stateless bean (from theory).

where should store id of retrieved user database, last until user decides logout?

you can store in session context:

facescontext.getcurrentinstance().getexternalcontext().getsessionmap().put("userid", email); 

use getsessionmap()#get("userid") in order check stored userid.

with approach session user delated when closes browser without logging out(if no, how can expire his/her session automatically after while if there not activity?)

no, session expire automatically when reaching timeout. timeout can set in web.xml:

<session-config>    <session-timeout>60</session-timeout> </session-config> 

this setting means, sessions time out after 60 minutes of server inactivity.