Using JSF and j_security_check , how can I implement the remember me functionality? Now I can add remoteUser to the cookie and find User . From user I can extract login and password(hash) . When using req.login(user.getLogin(), user.getPassword()) I get a Security Exception , as I understand it because of j_security_check .

    1 answer 1

    Just need to develop its own authentication mechanism, which is implemented quite deeply in the depths of the application server, in the processing of http-request. The javaee standard does not cover this aspect. Learn the insides of a specific application server. And in addition, the authentication module is already by the standards (I do not remember the name).
    This is if you want to use all the services of javaee: @RolesAllowed there ... so that the user and his roles in the EJB are recognized ...

    If you can do without it, then you can find a solution on the filters. For example Apache Shiro. But there javaee does not work, there its own implementation of secrecy, which does not fit in with javaee.

    It is possible to do authentication in a fashionable way, using a separate login server (and one for all or only for some applications).
    Keycloak has a lot of features. Remember me is not even the main one. There is an implementation of the authentication mechanism for Wildfly servers, so standard annotations and EJBs work there. The main thing is to figure out how to drive your user base there. It is not very difficult.

    • Listen, you couldn’t throw off fine articles or materials on java ee. I'm just a junior, much of what you wrote is not clear. Or leave some contacts where you can be contacted and you would drop the materials. For earlier thanks - user211789
    • There is nothing on javaee except the standard manual, which is on the oracle website. What is not there is a description of the structure of the finished files: war, ear, etc. descriptions of deployment descriptors. It is often necessary to know something to twist. It is necessary to google. Also, there is no detailed description of all APIs. It is always necessary to know. Watch javadoc in javaee classes, google. You can watch the competing Spring. Previously, he had no alternative. But time passes, everything changes. - Sergey