0
  • There are two web-applications deployed on a glassfish server.
  • Both web applications provide a REST web service.
  • the access to both web-services is secured via glassfish security constraints (at the moment BASIC Auth and file-realm).

Let's say a user is accessing the service of web application A. After he is authorized, service A wants to call service B via REST client.

Is there a way for a service to impersonate a user that is already authorized to the glasfish server? Maybe something like forwarding the security context or editing the headers? Is there another Filter?

@Context
private SecurityContext securityContext;

username = securityContext.getUserPrincipal().getName();
password = ???    

client.addFilter(new com.sun.jersey.api.client.filter.HTTPBasicAuthFilter(username, password));

Thanks!

Matthias
  • 313
  • 1
  • 8

1 Answers1

0

It will depend on the authentication scheme, but in some cases you could consider extracting the Authorization header received by Service A and pass it to Service B. That would work with basic authentication.

You should be able to use @HeaderParam to do that, like in the following snippet:

@GET
@Path("/resourceA")
public void doSomething(@HeaderParam("Authorization") String authorization) {
  // now I can call resourceB and use 'authorization'
}
Olivier Liechti
  • 3,138
  • 2
  • 19
  • 26