title: Glassfish authentication process
body: <p>I don't understand well the process of authentication with Glassfish (V3 in my case).</p>
  
  <p>With JSE simple application, we are using JAAS API to authenticate users with callback handler and login context.</p>
  
  <p>With application servers like Glassfish, we are using realms to authenticate users. These realms use JAAS but implement some applicative logic code to plugin into Glassfish structure and credentials are passed via container to the realm to authenticate user. Credentials are obtained via "kind of" callback handler which are BASIC, FORM, DIGEST and CLIENT-CERT.</p>
  
  <p>Is that right ?</p>
  
  <p>Now, there are SAMs (Server Authentication Module) too and I don't know exactly at what time they occur in authentication process ? I think SAMs occur before realm in request process but I'm not sure...someone can confirm ? Are SAMs callback handlers ?</p>
  
  <p>Thanks</p>