Java EE (Java Enterprise Edition) General Discussion

With JSP, I use a servlet filter to do login/access control. This will watch through out all the pages needed to be secured. I could not find any mention/tutorial on what's the best way to use JSF and access control.

Sure, it's easy to build a login page using JSF, but what I mean is to check through out the whole protected area/user session to make sure the user has the right to access certain area. Also, how to manage session time out setting in the JSF.

Did you do this? What's the right way for doing this?

Thank you very much.