How to Login a User into my RESTFul Webservice for use with javax.ws.rs.core.SecurityContext

Question

I am currently stuck at implementing security into my RESTFul Webservice. I have found out that there is a SecurityContext which is easy to use and then again got stuck at putting my user information into it.

@GET
@Path("item/{item_id}")
@Produces(MediaType.APPLICATION_JSON)
public Item getItem(@Context SecurityContext sc, @PathParam("item_id") Long id)
{

    if(!sc.isSecure())
        throw new SecurityException("You have to use a secure connection!");
    if(!sc.isUserInRole("admin"))
    {
        throw new SecurityException("You have to be an admin to access this information");
    }
    return itemFacade.find(id);
}

So my problem is that I need to write a Login for my Webservice but I don't know how to do so (so I can use it with the SecurityContext object). If there is no possibility to use the SecurityContext Object I would appreciate it if you could get me some links so I could work through them. Also it has to be up-to-date technology, meaning if it is possible without modifying the web.xml file and only managing this with Annotations, this would probably the best approach.

I am working with NetBeans 7.3, JavaEE6 and use GlassFish as Application Server.

Answer 1

For Authentication and authorization, you should consider using JAAS. The JAAS API consists of a set of Java packages designed for user authentication and authorization. It implements a Java version of the standard Pluggable Authentication Module (PAM) framework and compatibly extends the Java 2 Platform's access control architecture to support user-based authorization. JAAS was first released as an extension package for JDK 1.3 and is bundled with JDK 1.4+. Because the JBossSX framework uses only the authentication capabilities of JAAS to implement the declarative role-based J2EE security model, this introduction focuses on only that topic.

JAAS authentication is performed in a pluggable fashion. This permits Java applications to remain independent from underlying authentication technologies and allows the JBossSX security manager to work in different security infrastructures. Integration with a security infrastructure can be achieved without changing the JBossSX security manager implementation. All that needs to change is the configuration of the authentication stack that JAAS uses.

Here are the tutorials for your further help:

http://www.kopz.org/public/documents/tomcat/jaasintomcat.html

http://www.javacodegeeks.com/2012/06/java-jaas-form-based-authentication.html