Security is always a concern you must have when implementing applications that will run in production environments. Both the JVM and Payara Server have a strong tool set of security implementations for most use cases in the industry, so you won’t have to worry about implementing your own security measures from scratch.

In the fifth part of our continuing series on alternatives for commercial Oracle GlassFish features, we are looking  at a replacement for the Oracle's Access Manager integration feature.

In this three-parts article series I'm illustrating the implementation of the LDAP integration using a sample scenario: integrate Payara Server with a LDAP user directory and manage the authentication and authorization of a sample web application.

In Part 1, I showed you how to start the LDAP Server, while in Part 2  we configured the LDAP realm. Now you are probably wondering how to get the user’s information (first and last name, email address, etc.) that resides in the LDAP server. Unfortunately, the JAAS API doesn’t offer any standard mechanisms to access this user attributes in the directory tree. But there are other options available:

See 'Part 1 - Configuring the LDAP Server' here.

In this three-parts article series I will illustrate the implementation of the LDAP integration using a sample scenario: integrate Payara Server with a LDAP user directory and manage the authentication and authorization of a sample web application.

One of the most common administration tasks with Payara Server, as well as with any web server, is to set up certificates to secure either HTTP protocol or remote access to Payara Server administration interface. You might have a self-signed certificate or a certificate signed by a trusted authority. In both cases it is pretty easy to add them to a Payara Server domain and use them to secure communication channels. 

This hot fix removes an arbitrary file read exploit that allows an attacker to read the content of any file on the server hosting the DAS. This exploit attacks the administration console with a specific string, bypassing secure administration and any required login details. Therefore, if the administration console is not publicly accessible, and Payara Server is running under a restricted user (as per best practice), then the risk is minimised.