Why Use JAAS?
The latest release of the Java 2 Software Development Kit, v 1.3 provides a means to enforce access controls based on where code came from and who signed it. The need for such access controls derives from the distributed nature of the Java platform, where, for instance, a remote applet may be downloaded over a public network and then run locally. The Java 2 platform, however, lacks the means to enforce similar access controls based on who runs the code. To provide this type of access control, the Java 2 security architecture requires additional support for authentication (determining who’s actually running the code), and extensions to the existing authorization components to enforce new access controls based on who was authenticated. The Java Authentication and Authorization Service (JAAS) framework augments the Java 2 platform with such support.
