And another thing... Tim Quinn's Blog

Hello, Vamsee. The idea of an application client container (ACC) is described in the Java EE spec. The basic idea is that the ACC provides services that make it easier to write client programs that use enterprise components (like EJBs), much the same way an EJB or web container makes it easier to develop those types of components on the server side. The GlassFish ACC provides automatic support for annotations and dependency injection, security, and logging for example. This link to the GlassFish documentation on developing clients will explain a little more: https://glassfish.dev.java.net/javaee5/docs/DG/beakt.html To answer your specific questions about security and Java Web Start, Java Web Start enforces a security sandbox similar to applet security sandboxes to protect users from downloaded software that might harm their systems. As you point out, Java Web Start requires that if the downloaded code needs to do things that the sandbox does not permit then the downloaded JAR must be signed and the JNLP that lists that JAR must specify <all-permissions>. When Java Web Start starts to launch the application it makes sure that the code is to be trusted, either by prompting the user or by checking that the certificate used to sign the JAR can be traced to a trusted certificate authority. The GlassFish ACC does help with security in the following way. (Again, reading the Java EE platform spec section about the ACC will help as well.) A developer can write his or her app client code that refers to a guarded EJB without having to write the authentication code. When the app client tries to contact a guarded EJB the ACC automatically prompts the user for a username and password. The ACC provides a simple form for this purpose that it uses by default, but the developer can provide a custom one instead if he or she wants to. The ACC works with the back-end to perform the actual authentication to make sure that the username and password the user entered should be granted access to the EJB.

Posted by Tim Quinn on June 11, 2007 at 08:33 AM CDT #