Java Authentication & Authorization (JAAS) Explained
Authentication ("who are you?") and authorization ("what may you do?") are different problems, and Java's JAAS framework has handled both for over two decades. This guide explains the concepts, the framework, and the modern patterns around it.
Decode JWT header and payload, check expiry — without sending the token anywhere.
Authentication vs authorization, clearly
Authentication verifies identity: passwords, certificates, tokens, biometrics. Authorization decides permissions after identity is known: can this user read this record, call this API, delete this file? Every secure system does both, in that order — and confusing them is the root of many security bugs (a logged-in user is not automatically an authorized user for every action).
What JAAS is and how it works
JAAS (Java Authentication and Authorization Service) is Java's pluggable framework for both: LoginModules verify credentials against any source (files, LDAP, databases, Kerberos), producing a Subject (the authenticated user) with Principals (identities and roles). Authorization then checks the Subject's Principals against policies. The power is pluggability: swap a LoginModule and you change the credential source without changing application code.
Machine-to-machine authentication
When services talk to services (no human involved), the standard pattern is OAuth 2.0 client credentials flow: the calling service authenticates with its own client ID and secret (or certificate) and receives a short-lived access token, which it presents to the target service. No user passwords are shared between services, tokens expire, and each service has its own identity — the same auth-vs-authz split, applied to machines.
Signature algorithms, briefly
Signatures prove a message came from a key holder and was not altered: RSA (widely supported, larger signatures), ECDSA (smaller, modern default for many systems), and EdDSA/Ed25519 (fast, modern, increasingly standard). JWTs (inspect one with our JWT Decoder) carry signatures using these algorithms — the algorithm is named in the token header, and verifying it is what makes a token trustworthy. Never accept a token whose signature you did not verify, and never use the "none" algorithm in production.
Frequently asked questions
Is JAAS still used in modern Java?
Yes, especially in enterprise and Jakarta EE applications, though many newer apps use Spring Security (which can sit on top of JAAS concepts) or OAuth/OIDC libraries.
What is the difference between JAAS and OAuth?
JAAS is a Java framework for authentication and authorization mechanics; OAuth is a protocol for delegated authorization (letting an app act for a user). They solve different layers and are often used together.
Should I build my own authentication?
Almost never. Use established libraries and protocols (OAuth 2.0/OIDC, Spring Security, or your framework's auth) — custom auth is where the worst vulnerabilities hide.