How to secure Java web services with login and session

Question

I want my (Java metro) web service with login.

Here's how I plan to do this:

The steps required when calling the webservice method:

• call login (user, pwd), get session token 1.1 remember token
• servicemethod call (token, arg1, arg2 ...)
• webservice checks if a token is known if no exception is thrown, otherwise continue
• logout or timeout after x periods of inactivity

my questions are: 1. What is your opinion on this approach? does that make sense? 2. Are there libraries that take responsibility for processing the session (possibly with saving the database in order to survive application reloading).

(the solution should be simple and convenient for use with Java and .NET clients)

thank!

Answer 1

This is possible, and I have seen web services using a similar approach. But I would not implement my own solution. Instead, I would use the security token from the WS-Security specification and, more precisely, the user token (you get this from the WSIT , which is part of Metro and thus interacts with .NET clients). See this article for an introduction.

Update: Other pointers:

• Implementing a UserToken WS-Security Profile for Metro-Based Web Services
• What's New in Web Services Enhancements (WSE) 3.0
• WebService Authentication with UsernameToken in WSE 3.0
• UsernameToken WSE 3.0

, WS-Security , , , , WS-Security , , ( ).

Edit:

, . , , .

Answer 2

. J2EE/ Java /. , .

- -; Apache HTTPD, Tomcat.

Answer 3

I thought about trying out Apache Shiro , I can’t say how good it is. Looks good.