What are the alternatives for Java authentication?

Preferably something that integrates well with a Flex front end. Yes the Spring Security guys say this is possible, but all examples seem to use legacy jsp tag libraries making them half useless as examples. I don't want to spend a month setting up and learning how to use a security tool. I would like a tool which supports using annotations (@RolesAllowed etc), MINIMAL XML, and 'remember-me' features (not cookie based).

Apache Shiro se开发者_JS百科ems to support Flex/Silverlight/Swing as well but I'd like to know if there are any other alternatives that are NOT container specific.

Turns out Apache Shiro is actually a simpler and easier to learn solution than Spring security. And no stupid xml configuration is nice.

Spring Security is by far the best tool out there.

BlazeDS is no magic. It is ultimately just a call to the server over HTTP. The Blaze application is just a war file, and has traditional urls. So, to protect the services, you have to protect the urls in your web.xml / spring configuration files.

Essentially, read the documentation of Spring Security/JAAS, and substitute the jsps with the urls of your blaze services.

Spring Security also has support for Roles and authorization. It also has a remember-me functionality, but that absolutely uses cookies. You cannot have a remember-me functionality without cookies.

Regarding authentication, it is possible to pass the authentication token as a request parameter instead of a cookie. But cookies are recommended, and are a lot easier to get right.

And finally, security is pointless without using https. You absolutely must use https throughout your application if you care about security.

I don't see why Flex should authenticate anything, after all that is the client side. Whats stopping someone from decompiling your flash/flex?

For most people Apache Shiro is overkill and they just roll their own. Which isn't the best idea to be honest. I have seen a lot of horrible authentication systems over the years. Cookies are meant to keep track of the session for the client, why use anything else?

Edit: Use spring secuirty for authentication.