How to go about web service security in Java

Question

Does anyone have a recommendation about web service security architecture in Java (preferably under JBoss)? Any recommended reading?

I want to expose a fairly rich web service to the world but the data are sensitive and it requires authentication from the current client (Flex), accessed via RPC. I definitely do not want any server-side session state.

What's the best way to go about implementing security through web services in Java/JBoss and where can I read about it?

Answer 1

For web services security in JBoss, I would start by reading 8.4 WS-Security of the JBossWS User Guide.

Answer 2

WSSE is simple and works well.

http://www.xml.com/pub/a/2003/12/17/dive.html

http://www.sixapart.com/developers/atom/protocol/atom_authentication.html