3

I have written REST web service in java using spring MVC. As this service is stateless, how I can secure it using siteminder? For login authentication, we are using siteminder at frontend.

FullStackDeveloper
  • 910
  • 1
  • 16
  • 40
jinal
  • 71
  • 1
  • 7

1 Answers1

2

You can protect the web services URLs with CA SSO (aka SiteMinder) the same way you protect the user-facing parts of your website. Just create realms/rules/policies for the URLs. But there are some caveats/tricks:

  1. Include the SM session cookie in the client request
  2. Remember if the cookie is flagged HttpOnly, it won't work
  3. Use BASIC authentication for the realms - this way, your clients will receive a 401 if they aren't authenticated/authorized
  4. Also be wary of CORS restrictions if your web services aren't on the same hostname as the main page(s) of your app

HTH!

Richard Sand
  • 642
  • 6
  • 20