Đôi khi người dùng cần phải thay đổi danh tính xác thực. Điều này có thể xảy ra khi một người dùng xác thực cố gắng truy cập vào một nguồn tài nguyên Web được bảo hộ và từ chối vì thiếu quyền truy cập vào tài nguyên. Mặc dù người dùng có thể thoát khỏi trình duyệt | AUTHENTICATION 287 security-constraint web-app Code Example SSL Hybrid Authentication Mechanism Changing Authentication Identity Sometimes users need to change authentication identities. This could happen when an authenticated user tries to visit a protected Web resource and is rebuffed for lack of access authority to the resource. Although the user can exit the browser and restart the authentication process this is not always acceptable. Applications should give the user an opportunity to invalidate the authentication session and reauthenticate as a more appropriately privileged identity. The error-page element may be used in the deployment descriptor of a Web application to configure a resource to be invoked by the Web container when the processing of an HTTP request produces a particular HTTP error code. This functionality may be employed to redirect an unauthorized request to a resource within the Web container that gives the user an opportunity to invalidate its authentication session. For example the error-handling resource could return a form to the user containing the URI and parameters of the unauthorized request. The form would provide the user with an option to invalidate the current authentication session. Choosing to invalidate would cause the form containing the URI and parameters to be submitted to the Web container where a session invalidation resource would be invoked. This resource would invalidate the current authentication session by calling . It then redirects the user via the embedded URI and parameters to the original unauthorized resource. EJB Tier Authentication Prior to J2EE and EJB the J2EE platform did not require that EJB containers implement specific authentication mechanisms. Moreover in many environments network firewall technology prevents direct interaction via RMI between client containers and enterprise beans. As a result it is common for an EJB container to rely on the .
