Camel CXF - Security (Authentication)

Question

I created a webservice with apache camel using CXF component as bellow :

blueprint.xml:

  <bean class="ngtrend.ws.Testws"/>
  <!-- Defined the server endpoint to create the cxf-rs consumer -->
  <cxf:rsServer id="rsServer" address="http://localhost:9050/route"
    serviceClass="ngtrend.ws.Testws"     />
  <camelContext xmlns="http://camel.apache.org/schema/blueprint">
    <route id="timerToLog">
      <from uri="cxfrs://bean://rsServer"/>
      <to uri="bean:ngtrend.ws.HelloBean?method=test(Exchange)"/>
      <log message="${body}"/>
    </route>
  </camelContext>

Testws.java:

public class Testws {
    @GET
    @Path("/test/{id}")
    @Produces("application/xml")
    //@Consumes("text/xml")
    public Integer getAssets(@PathParam("id") int id){
        return null;
    }
}

and I would like to secure it forcing the customer to send ( or enter on a dialog box if using a browser) login and password (BASIC Http authentication). How can i make this configuration ?

Answer 1

In CXF framework, restful services authentication can be done by using the following approach:

<cxf:rsServer id="rsServer" 
              address="http://localhost:9050/route">

    <jaxrs:serviceBeans>
                 <ref bean="serviceBean"/>
        </jaxrs:serviceBeans>

        <jaxrs:providers>
            <ref bean="authenticationHandler"/>
        </jaxrs:providers>  

</cxf:server>


<bean id="serviceBean" class="ngtrend.ws.Testws"/>

<bean id="authenticationHandler" class="yourpackage.Class" />

Create your own handler for authenticationHandler that will implement import org.apache.cxf.jaxrs.ext.RequestHandler . Use the authentication strategy needed in this class , for example authenticate against database etc.. This should allow for basic authentication.

Answer 2

You can write a class which implements ContainerRequestFilter. And then set it in the cxf:providers as below:

<bean id="authenticationHandler" class="a class which implements ContainerRequestFilter" />
<cxf:rsServer id="xxxRsServer"
    address="/xxxservice" serviceClass="xxx.XXXService"
    loggingFeatureEnabled="true" loggingSizeLimit="20">
    <cxf:providers>
        <ref component-id="authenticationHandler"/>
    </cxf:providers>
</cxf:rsServer>

In this way, you could override below method

public void filter(ContainerRequestContext requestContext)

For example, you could make a simple authentication based on requestContext.getHeaderString("UserPassInfo"). If succeed, do nothing, otherwise call requestContext.abortWith(Response.status(401).header("WWW-Authenticate", "Basic").build());