Secured Web Service Authentication

Question

I am developing a web service using the Spring framework for Java and deploying to JBoss AS. This web service needs authentication and permission and a security solution so that some user method A can execute, and another user B can execute. On the client side there will be an application that calls the web service, and people can log in using either user account A or B.

I dug up the Internet, searched for web service authentication, explored WS-Security, but everything I see uses WS-Security. WS-Security usually provides 4 types of authentication:

• UsernameToken
• X.509 Token
• SAML Current
• Kerberos Toner

But all of these things are usually preconfigured, and I don't see examples that suggest that I should provide login / logout methods for the web service (using stateful web service). Please note that if you use login methods, there are security risks, even if the underlying SSL transport.

So my question is:

• What should I do to satisfy my requirements?
• If you use a UsernameToken or Kerberos Token ... and provide some privileges for each user, that is, for each incoming request, we must get information about the user and get all his privileges. This process seems to take time and reduce system performance. Do you agree? So I think this is not recommended?

I would thank you for any answer and would vote for any reasonable answer.

Answer 1

• If your service points to a point, ssl is enough. Mutual ssl ( Mutual_authentication ) is widely used for authN and authZ clients.

• If you go to work with the system, look at SAML. SAML is a signed XML document containing authN and authZ for the client, which means that you do not need to loop around the server for the authN and authZ clients.

Answer 2

Your scenario reflects what the EBay Trading API is .

Basically, it works as follows.

• Provide an internal WS-call (Ebay case: FetchToken) that confirms the user's identity and returns an authorization key (a unique key for each registered user). Save the authorization key along with user profile information in the cache / distributed cache.
• Any subsequent call required by the client must pass the authorization key along with the data for the call. You will use the authorization key to get information about the user profile.
• Provide a WS-Out call. This will invalidate the authorization key.

All WS calls must be made over SSL for security.