One security concept for multiple wars on embedded jetty

Question

I have an embedded jetty server with multiple wars. Each war is one part of one web application. The goal is to add the same security to all wars. My preferred security mechanism would be spring security.

There might be two solutions:

a) Define security in each war.

I could define a servlet filter in each web.xml. Problem: How can I use the same security among the different wars? Redundancy: I would have to add the same config to all web.xml.

b) Define security filter for path /*

How can I set the spring security to filter everything on the jetty?

Answer 1

What about using Apache Shiro. See Shiro vs. SpringSecurity for further information.

Super Simple Application Security with Apache Shiro by Les Hazlewood is a great introductory screencast.