This will sound naive for sure, and it is. Being a recent college graduate, I have been wondering on how do average websites implement their authentication modules. I have been using a table storing username and hash(password) and their roles (for authorization). All I do is string-matching and done! Then install an SSL cert. This sounds too simple in practice !!
Then I look at the enterprise systems which implement JAAS and stuff like that, which sounds too complex for a small-medium business.
How does an average team consider writing an authentication/authorization module ? This is a language/platform agnostic query. I would be obliged to get any suggestions.