Secure EJB3.1-Webservice (in JBoss Wildfly 8.2)

Question

I have a nearly finished web project with EJB3.1 deployed as WAR in Wildfly 8.2. It´s secured by a self-written JAAS-realm with form authentication (auth-method FORM).

Now I want to add a EJB-Webservice which is basically defined as

@Stateless
@WebService
public class ProductImportWebservice {
    @Resource 
    WebServiceContext wsContext;

    [...]

    @WebMethod
    public Product createOrFind(String name) {
       [...]
    }
}

The webservice works as expected but now I have the problem that I want to protect access to the Webservice by username/password. So I annotated the webservice or the @WebMethod with

@RolesAllowed("ADMIN")

which is a valid role in the JAAS-authentication. Effect: The SOAP-client gets the answere "reqeust not allowed / not authenticated" - but gets no authentication-request and attempts with BASIC-authentication are ignored. If I add the URL of the webservice to the security-constraint in the web.xml I get an authentication request... but the problem now is that it´s the form based authentication - as a user with a browser would expect it. This is unusable for a "normal" SOAP-client :-(

The concrete question now is: Is there a way to have both - BASIC authentication for the webservice and FORM-based authentication for the rest of the application?

The only other way I would see is to split the WAR package up to an EAR-package and deploy the webservice in a different web-context.

score 1 · Answer 1 · answered Jun 29 '16 at 07:58

1

The concrete question now is: Is there a way to have both - BASIC authentication for the webservice and FORM-based authentication for the rest of the application?

You can't use both FORM and BASIC authentication for the same web application.

If you need to do this, create two separate applications, with a shared codebase.

Reference:

https://docs.oracle.com/javaee/7/tutorial/security-webtier002.htm#JEETT01227

The auth-method subelement configures the authentication mechanism for the web application. The element content must be either NONE, BASIC, DIGEST, FORM, or CLIENT-CERT.

answered Jun 29 '16 at 07:58

ck1

5,243
1
21
25

Not the answere I hoped for but I think you´re right. I think I´ll go another way: add the webmethod-parameters with user-credentials und check them on my own :-( – cljk Jun 29 '16 at 08:05
Just wanted to add: In the end I extended my Webservice with a funktion "login" which delegates the login-process to HttpRequest.login - wich basically calls the JAAS-check.... in the protected methods I check the role-membership by checking wsContext.isUserInRole(...) and the WS-Client simply maintains sessions as mentioned in http://stackoverflow.com/questions/14699114/jax-ws-client-maintain-session-cookies-across-multiple-services It works like a charme and was much less work than splitting up the project. – cljk Jun 29 '16 at 09:28
@cljk You could also try your luck with JASPIC, which is standard and allows you to stack multiple authenticators (`ServerAuthModule`s) as you please. I doubt it will be trivial to set up for use with both Servlet and JAX-WS though. – Uux Jun 29 '16 at 09:34

Secure EJB3.1-Webservice (in JBoss Wildfly 8.2)

1 Answers1