In my application, the architecture goes like this: There is web server. The web server runs Tivoli/Webseal. It creates junctions to the portal server and then portal server dispatches requests to a WAS.
Now I see they are using spring portlet mvc in the portlets that are running on portal server. And they are using spring security in the portlets.
Now my question is if all requests are routed through Webseal and the portal server is sitting behind a firewall, is there really any need to use spring security in the portal layer? Or is it just for extra safety?