When choosing among the different types of authentication mechanisms offered
by J2EE Web containers, form-based authentication is almost always selected
ahead of its alternatives: HTTP basic authentication and HTTPS client
authentication. However, beneath the customizable user interface, form-based
authentication presents several challenges to architects looking for a robust
enterprise authentication solution.
These challenges often manifest themselves as login-page access errors that
arise when applications look to extend the concept of protected resources
upon which form-based authentication is predicated. This can occur when a
system exhibits requirements that are considered fairly common for an
enterprise application, such as:
Authentication must be possible from the default formbased login page
without trying to first access a protected resource. Capture of
a... (more)