title: Concept of JSF, EJB and form based login with JDBC-Realm
body: <p>I am trying to learn the concepts of Java EE (EJB,JSF...) and therefore I am working on an example application.
  Unfortunately I have problems to understand how some concepts should work together and if I am doing it in an correct professional manner. At this point, I am really confused about all these different methods and hope someone can help me out.</p>
  
  <p>The core functionality of my application consists of a document server where registered users can upload documents and describe it with useful information.</p>
  
  <p>The Documents should simply be saved on the Server and all Information should be stored in a MySQL Database.
  I created three Projects with Netbeans.</p>
  
  <ul>
  <li>Enterprise Application Project (DocApp)</li>
  <li>EJB Module (DocApp-ejb)</li>
  <li>and a Web Application Project (DocApp-war).</li>
  </ul>
  
  <p>The main things work fine like </p>
  
  <ul>
  <li>accessing the database with JPA </li>
  <li>uploading files with primefaces FileUploader</li>
  <li>injecting JSF with EJB </li>
  <li>and even the <strong>user authorization</strong> with <strong>JDBC-Realm</strong> as shown in this tutorial
  <a href="http://jugojava.blogspot.de/2011/02/jdbc-security-realm-with-glassfish-and.html" rel="nofollow">http://jugojava.blogspot.de/2011/02/jdbc-security-realm-with-glassfish-and.html</a></li>
  </ul>
  
  <p>My Problem now is, that all pages in a specific subdirectory should only be accessible by <strong>registered users</strong>.</p>
  
  <p>The only way i see is to use one <strong>SessionScoped</strong>  <strong>ManagedBean</strong>, instead of using multiple <strong>RequestScoped</strong>  <strong>ManagedBeans</strong> .
  This seems to be a bad practice but I have no Idea how to handle this otherwise.
  The way i understand it, there should be one ManagedBeand for every JSF Page (xhtml).</p>
  
  <p>Is there a good way to handle this or am i doing anything wrong?</p>