I made a question about JAX-WS, Authentication and Authorization - How to?; there was a discussion about security levels, and where to store user credentials.

Now after some conclusions, I want to try one of those scenarios:

  • SOAP web services - metro
  • Message level security - Mutual certificate authentication, to authenticate the client application
  • User credential in the Soap Header

How to get the credentials and do the authorization? I have 2 ideas:

  • JAAS (I don't know anything about this);
  • SOAP handler - using the WebServiceContext to extract the credentials from the message and do the authorization "by hand".

Can you help me to decide the best way, and how to implement it?

Remember that I want mutual certificate, plus a user token.

java soap jax-ws ws-security
Edit
Report