Portable security role mapping with jdbc realms
I am finalizing a Java EE 6 application. The app has been developed using GlassFish, but I want to make it portable across different application servers.

The security has been implemented by defining users and groups in the application's DataSource, and so by using GlassFish's jdbcRealm. I know that there exist similar implementations in other App Servers (although I haven't looked at the details, yet).

In order to make my app portable, I need to understand if **the mapping between Security Roles and principals / users** can be defined in the app server itself, or in the application source code, without using the app-server-specific deployment descriptor `glassfish-web.xml` or equivalent. This would avoid the deployer's task of editing the `.war` file, which is something I'd like, since the application has to be portable.

Since I have mapped the roles to application-defined groups with the same names, the code I'd like to remove is

      <security-role-mapping>
          <role-name>RoleGroup1</role-name>
          <group-name>RoleGroup1</group-name>
      </security-role-mapping>
      <security-role-mapping>
          <role-name>RoleGroup2</role-name>
          <group-name>RoleGroup2</group-name>
      </security-role-mapping>

Portable security role mapping with jdbc realms
===

I am finalizing a Java EE 6 application. The app has been developed using GlassFish, but I want to make it portable across different application servers.

The security has been implemented by defining users and groups in the application's DataSource, and so by using GlassFish's jdbcRealm. I know that there exist similar implementations in other App Servers (although I haven't looked at the details, yet).

In order to make my app portable, I need to understand if **the mapping between Security Roles and principals / users** can be defined in the app server itself, or in the application source code, without using the app-server-specific deployment descriptor `glassfish-web.xml` or equivalent. This would avoid the deployer's task of editing the `.war` file, which is something I'd like, since the application has to be portable.

Since I have mapped the roles to application-defined groups with the same names, the code I'd like to remove is

      <security-role-mapping>
          <role-name>RoleGroup1</role-name>
          <group-name>RoleGroup1</group-name>
      </security-role-mapping>
      <security-role-mapping>
          <role-name>RoleGroup2</role-name>
          <group-name>RoleGroup2</group-name>
      </security-role-mapping>
