how to secure apache cxf webservice(jax-ws) using oAuth 2.0

Question

I have deployed webservice in Tomcat using Apache CXF . How would I proceed in securing that web service using OAuth 2.0 ?

I have gone through the below URL but without finding any suitable solution. A working example or tutorials on how to implement oAuth 2.0 for simple web service?

Original tutorial link:

• JAX-RS: OAuth2

Answer 1

I was confronted with the same issue recently. After a decent amount of research, I have found (and this could be limited to me alone) that this is quite complicated.

It is possible to attach the required "authorization header" to a SOAP webservice call in this manner :

Map<String, Object> req_ctx = ((BindingProvider)port).getRequestContext();
req_ctx.put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY, WS_URL);

Map<String, List<String>> headers = new HashMap<String, List<String>>();
headers.put("key", Collections.singletonList("yourkey"));
//... all other parameters required.
req_ctx.put(MessageContext.HTTP_REQUEST_HEADERS, headers);

The request can then be checked on the server side as such :

MessageContext mctx = wsctx.getMessageContext();

//get detail from request headers
    Map http_headers = (Map) mctx.get(MessageContext.HTTP_REQUEST_HEADERS);
    List userList = (List) http_headers.get("key");
//... get other information required here

And thus you can validate the request.

---

On a side note

It is to note, from my findings, oAuth2 is not very useful for simply securing your API - simply protecting it from outside use.

The reasoning

With oAuth 1, you could use the authentication to validate a user by their key. You knew they were authorized because they have successfully signed the request, and thus you would allow them access to the information.

With oAuth 2, the protocol requires you to use HTTPS. Then why not just use application authentication with your API? I have found oAuth 2 to be very useful to access 3rd party applications with the original set of credentials (the goal of the protocol). But unless you need to do this, there is no need (again IMO) to implement the full oAuth. If you ONLY looking to secure your API, just do it using SSL and a key or username/password combination.

---

See also:

• Application Authentication With JAX-WS
• CFX User Guide
• How is OAuth 2 different from OAuth 1?
• Designing a Secure REST API without oAuth - more useful for general understanding .

Answer 2

I've added a short intro here: https://cwiki.apache.org/confluence/display/CXF20DOC/JAX-RS+OAuth2#JAX-RSOAuth2-OAuth2tokensandSOAPendpoints

Basically it will work with bearer tokens passed via Authorization headers as is, and can be easily customized to handle WS-Security binary tokens