IBM WebSphere Application Server - Express provides security components that provide or collaborate with other services to provide authentication, authorization, delegation, and data protection. WebSphere Application Server - Express also supports the security features described in the Java 2 Enterprise Edition (J2EE) specification.
An application goes through three stages before it is ready to run:
Most of the security is configured for an application during the assembly stage. The security configured during assembly stage is called declarative security because the security is declared or defined in the deployment descriptors. The declarative security is enforced by the security run time of which an application developer need not be aware. For some applications, declarative security alone is not sufficient to express the security model of the application. For those applications, you can use programmatic security.
See these topics for more information about programmatic security:
Develop secure Web applications
Develop servlet filters for form login processing
Develop with JAAS to log in programmatically
Develop your own J2C security mapping module