具有Spring和Spring Security的REST身份验证

Question

I want develop a RESTfull web service with authentication using Spring and Spring Security. All my users will be stored in the DB with an encrypted password and role. The session should be stored in the context until the session is timedout or logged out to allow consumption of other webservices.

If someone can help me would be great.

Thanks

Answer 1

Have a look at Jersey with Spring and its ContextSecurityFilter, I do not suggest to use spring security. If you make a good Authorization try to use @RolesAllowed method.

Answer 2

You need to create a spring security context and include in your web application.

     <security:http pattern="/../../../**" entry-point-   
       ref="CustomAuthenticationEntryPoint"
    <security:custom-filter ref="authenticationTokenProcessingFilter"
        position="FORM_LOGIN_FILTER" />
    <security:intercept-url pattern="/.*"
        access="isAuthenticated()" />
    <security:intercept-url pattern="/../../../.*"
        access="isAuthenticated()" />
    <security:intercept-url pattern="/../../../.*"
access="isAuthenticated()" /> />

and you can have decision voters depending on your URL or other.

    <bean id="accessDecision"          
         class="org.springframework.security.access.vote.UnanimousBased">
    <property name="decisionVoters">
        <set>
            <bean  
     class="org.springframework.security.web.access.expression.WebExpressionVoter">
    </bean>
            <bean c   
    class="org.springframework.security.access.vote.AuthenticatedVoter"></bean>
        </set>
    </property>
</bean>

You can have your own custom authentication entry point and add your code.

More details could be found here .