Authentication and Role in SOAP based Web Services (Java) [closed]

Question

Please Guide me to understand the following and which technology i should use for best implementation:

1. How Many type of Authorization/security we have and which one is the best.
2. How can we implement role based security.
3. Does the same applies to Restful services as well.

Answer 1

The first question can be interpreted in two ways. First, you ask for an authentication method, the protocol between the client and the server. Here are two:

• BASIC AUTH - the client sends username and password in plain text in the request. If you are making an internal service (inside your corporate network) or have an encrypted channel (HTTPS) this work fine.
• KERBEROS - this works fine in the windows world and everything is controlled from the Active Directory. But if you try to bring it to java, you are asking for nightmares.

Second, you can be asking for a java framework that handels security. This can be spring security for instance. Spring security positiones itself in the filter chain in front of your service. If the request (using BASIC_AUTH for instance) is permitted it gets through, otherwise not. Spring security can be configured to find the users in many many ways, database, your own code, ldap (and active directory).

The second question. Spring security handels roles excellent. I always let my intranet applications depend on roles my app fetch from AD through LDAP. It is quite easy to control what roles a user need to access a function. Kind of like this:

@Secured("ROLE_ADMIN")

The third question. It depends on your restful service framework, but most probably, yes, the same applies.