Included review comments from Will and fixed links.

bbuerkle · bbuerkle · commit b7ee5ebfecde · 2017-10-23T18:25:22.000-04:00
diff --git a/src/main/jbake/content/security-javaee002.adoc b/src/main/jbake/content/security-javaee002.adoc
@@ -153,11 +153,12 @@ authentication will be used to verify the identity of the user.
 It is important to keep in mind that security roles are used to define
 the logical security view of an application. They should not be confused
 with the user groups, users, principals, and other concepts that exist
-in GlassFish Server. Note that he Java EE Security API requires that group
-principal names be mapped to roles of the same name by default. You do not
-need to perform any additional steps to map the roles
+in GlassFish Server. Note that the Java EE Security API requires that group
+principal names be mapped to roles of the same name by default, but that implementations
+of the standard may allow configuration of a different default. In GlassFish Server,
+you do not need to perform any additional steps to map the roles
 defined in the application to users, groups, and principals that are the
-components of the user database in the `file` realm of GlassFish Server.
+components of the user database in the `file` realm.
 This mapping is set by default in the GlassFish Server Administration Console
 as described in link:security-intro005.html#BNBXV[Mapping
 Roles to Users and Groups].
@@ -413,14 +414,14 @@ authenticated caller's Subject. This method returns an empty
 `Set` if the caller is unauthenticated, or if the requested type is not found.
 +
 Where both a container caller principal and an application caller principal
-are present, the value returned by `getName()` MUST be the same for both
+are present, the value returned by `getName()` is the same for both
 principals.
 
 * `isCallerInRole()` takes a String argument that represents the role to be
 tested. The specification does not define how the role determination is made,
-but the result MUST be the same as if the corresponding container-specific call
-had been made (for example `EJBContext.isCallerInRole()`), and MUST be consistent with the result implied
-by other specifications that prescribe role-mapping behavior.
+but the result must be the same as if the corresponding container-specific call
+had been made (for example `EJBContext.isCallerInRole()`), and must be consistent with
+the result implied by specifications that prescribe role-mapping behavior.
 
 The `javax.ejb.EJBContext` interface provides two methods that allow the
 bean provider to access security information about the enterprise bean's
diff --git a/src/main/jbake/content/security-webtier002.adoc b/src/main/jbake/content/security-webtier002.adoc
@@ -412,6 +412,8 @@ but instead by invoking `SecurityContext.authenticate()` with the credentials th
 collected.
 |=======================================================================
 
+
+
 [[GEXFA]]
 
 .*Figure 51-2 Form-Based Authentication*
diff --git a/src/main/jbake/content/security-webtier003.adoc b/src/main/jbake/content/security-webtier003.adoc
@@ -184,15 +184,15 @@ available only from the application principal. This method returns an empty
 `Set` if the caller is unauthenticated, or if the requested type is not found.
 +
 Where both a container caller principal and an application caller principal
-are present, the value returned by `getName()` MUST be the same for both
+are present, the value returned by `getName()` is the same for both
 principals.
 
 * `isCallerInRole()` takes a String argument that represents the role to be
 tested. The specification does not define how the role determination is made,
-but the result MUST be the same as if the corresponding container-specific call
+but the result must be the same as if the corresponding container-specific call
 had been made (for example `HttpServletRequest.isUserInRole()`,
-`EJBContext.isCallerInRole()`), and MUST be consistent with the result implied
-by other specifications that prescribe role-mapping behavior.
+`EJBContext.isCallerInRole()`), and must be consistent with the result implied
+by specifications that prescribe role-mapping behavior.
 
 Servlet 4.0 specifies the following methods that enable you to access
 security information about the component's caller.
diff --git a/src/main/jbake/content/toc.adoc b/src/main/jbake/content/toc.adoc
@@ -2719,8 +2719,14 @@ link:security-api.html#using-the-java-ee-security-api[53 Using the Java EE Secur
 
 * link:security-api004.html#running-the-built-in-database-identity-store-example[Running the Built-In Database Identity Store Example]
 ** link:security-api004.html#overview-of-the-built-in-database-identity-store-example[Overview of the Built-In Database Identity Store Example]
+*** link:security-api004.html#define-the-users-and-groups-in-the-identity-store[Define the Users and Groups in the Identity Store]
+*** link:security-api004.html#map-the-databaseidentitystore-to-the-default-data-source[Map the DatabaseIdentityStore to the Default Data source]
+*** link:security-api004.html#specify-the-authentication-mechanism[Specify the Authentication Mechanism]
+*** link:security-api004.html#declare-roles-in-the-servlet-container[Declare Roles in the Servlet Container]
 ** link:security-api004.html#running-the-built-in-db-identity-store-example[Running the built-in-db-identity-store Example]
-
+*** link:security-api004.html#to-build-package-and-deploy-the-built-in-db-identity-store-example-using-netbeans-ide[To Build, Package, and Deploy the built-in-db-identity-store Example Using NetBeans IDE]
+*** link:security-api004.html#to-build-package-and-deploy-the-built-in-db-identity-store-example-using-using-maven[To Build, Package, and Deploy the built-in-db-identity-store Example Using Maven]
+*** link:security-api004.html#to-run-the-built-in-db-identity-store-example[To Run the built-in-db-identity-store Example]
 * link:security-api005.html#running-the-custom-identity-store-example[Running the Custom Identity Store Example]
 ** link:security-api005.html#overview-of-the-custom-identity-store-example[Overview of the Custom Identity Store Example]
 ** link:security-api005.html#running-the-custom-identity-store-example[Running the custom-identity-store Example]
