I cannot speak for Beans; but, most frameworks that I have worked with provided ready to use authentication systems that have been subjected to security scrutiny. In rolling your own, you take a chance in succumbing to common pitfalls. If you must invent your own, then no, you should *NOT* have the password, even hashed, stored anywhere in your objects.
I would personally recommend running any authentication activities in a totally separate process so that its mechanisms are completely partitioned from your own. |