Securing Web Services with OPENAM

Question

I am trying to create a safe and possibly dosed web service in Java.

In my research, I got a lot of information about OpenSSO and thought it was my decision until I discovered what OpenAM took over and that OpenSSO is no longer being developed!

I have the latest version of Tomcat7 + OpenAM installed and started to configure it .

My goal:

I would like to have authentication on a session / token where users can request a token from the endpoint of a secure web service ( OpenAM seems to offer this ) than to include this token in subsequent HTTP requests to the endpoints of the web service protected by OpenAM.

I see guides on how to create an "agent policy" for Apache ... but not Tomcat yet? Maybe I'm just naive about how this works - maybe I would use the Java EE policy for Tomcat?

Finally, it’s nice to have: When a user clicks on a particular service, I can take my authenticated token and use it to “count” the service in any meaningful way (write down information about requests) - is there an API in OpenAM or should I plan it internal implementation in a web service?

My question is: are there any guides on them or examples of projects demonstrating this type of configuration. The OpenAM documentation is good, but I think I need a little more hands.

Answer 1

Take a look at this: https://wikis.forgerock.org/confluence/display/openam/OpenSSO+Spring+Security+(Acegi)+Integration

We see this as a possible solution. We plan to use Spring to help with our implementation.

Hope this helps.

Answer 2

Do you know wssagents? I think the following information solves your problem.

http://www.oracle.com/technetwork/java/wss-sdn-4-140497.html

ClientFilter matches token-based authentication. Web service endpoints are protected by ClientHandler and ServerHandler. OpenAM has web service security information, a WSC profile and a WSP profile, they have a security mechanism (SAML, Kerberos, etc.), encryption, etc.