Glassfish Web服务授权

Question

I've set up a web service using JAX-WS deployed to Glassfish 3.1.1. I've managed to set up SSL with client certificates (mutual authentication), but I can't figure out how to do proper authorization. I like to setup roles for read only access, for updating and deleting data.

The Java EE 6 Tutorial and the glassfish security guide state, that one cannot add users to certificate realm Java EE Tutorial . So what is the proper way to authorize users while using mutual authentication? Do I have to use usernames and passwords on top?

Answer 1

Take a look at http://docs.oracle.com/cd/E18930_01/html/821-2435/ggktf.html#gksdc

public class CertificateLM extends AppservCertificateLoginModule
{

    protected void authenticateUser() throws LoginException
    {
        // get the DN from the X500Principal.
        String dname = getX500Principal().getName();

        // retrieve the groups of the DN from an external source, e.g. from LDAP
        String[] groups = getGroupsFromLDAP( dname ); 

        if( groups != null ) {
             commitUserAuthentication( groups );
        }
        else {
             throw new LoginException( "DN is unknown." );
        }
    }
}