JAX-WS authentication agains a database

Question

I'm implementing a JAX-WS webservice that will be consumed by external Java and PHP clients.

The clients have to authenticate with a username and password stored in a database per client.

What authentication mechanism is best to use to make sure that misc clients can use it?

Answer 1

Basic WS-Security would work with both Java and PHP clients (amongst others) plugged in to JAAS to provide a database backend . How to implement that kind of depends on your container. Annotate your web service methods with the @RolesAllowed annotation to control which roles the calling user must have. All J2EE containers will provide some mechanism to specify against which JAAS realm users should be authenticated. In Glassfish for example, you can use the admin console to manage realms, users and groups. In your application.xml you then specify the realm and the group to role mappings.

Here are some details of how to achieve this on Glassfish

With JBoss WS in JBoss, it's even easier.

What JAX-WS implementation are you using and in which container?

Answer 2

Is there a way independent on the current container? I'd like to define which class is responsible for authorisation. That class could call database or have password elsewhere.

Answer 3

JAX-WS and BASIC authentication, when user names and passwords are in a database.