You can use the security services available from the web container to secure Representational State Transfer (REST) resources. You can configure security mechanisms that define user authentication, transport security, authorization control, and user to role mappings.
To appropriately define security constraints, it is important that you are familiar with your application and the RESTful resources that it exposes. This knowledge helps you to determine appropriate security roles required by your application as well as the individual resources it exposes.
To illustrate how to secure a REST application, this topic uses a sample REST application called AddressBookApp.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app id="WebApp_1255468655347">
<display-name>Sample REST Web Application</display-name>
<servlet>
<servlet-name>AddressBookApp</servlet-name>
<servlet-class>com.ibm.websphere.jaxrs.server.IBMRestServlet</servlet-class>
<init-param>
<param-name>javax.ws.rs.Application</param-name>
<param-value>com.test.AddressBookApplication</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>AddressBookApp</servlet-name>
<url-pattern>/rest/*</url-pattern>
</servlet-mapping>
</web-app>
In this example, the servlet mapping indicates
the REST resources are served under the /app_root_context/rest directory
where app_root_context is what you configured during the installation
of the application. The default root context is /. You must enable security for WebSphere Application Server.
You can use the web container to apply authentication as well as authorization constraints to a REST application running in the application server environment. Authentication is a basic security requirement for business REST resources that require a minimum level of security and might need to further protect resources based on the identity of the caller.
After you define security constraints, access to the REST resources that are defined in your application is subject to successful user authentication only. Additionally, you have applied role constraints to various resource URL patterns to enable role-based access to those resources.
<web-app id="WebApp_1255468655347">
<display-name>Sample REST Web Application</display-name>
<servlet>
<servlet-name>AddressBookApp</servlet-name>
<servlet-class>com.ibm.websphere.jaxrs.server.IBMRestServlet</servlet-class>
<init-param>
<param-name>javax.ws.rs.Application</param-name>
<param-value>com.test.AddressBookApplication</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>AddressBookApp</servlet-name>
<url-pattern>/rest/*</url-pattern>
</servlet-mapping>
<security-constraint id="SecurityConstraint_1">
<web-resource-collection id="WebResourceCollection_1">
<web-resource-name>AddressBookApp</web-resource-name>
<description>Protection area for Rest Servlet</description>
<url-pattern>/rest/addresses</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint id="AuthConstraint_1">
<description>Role1 for this rest servlet</description>
<role-name>Role1</role-name>
</auth-constraint>
<user-data-constraint id="UserDataConstraint_1">
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<security-constraint id="SecurityConstraint_2">
<web-resource-collection id="WebResourceCollection_2">
<web-resource-name>AddressBookApp</web-resource-name>
<description>Protection area for Rest Servlet</description>
<url-pattern>/rest/addresses/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint id="AuthConstraint_2">
<description>Role2 for this rest servlet</description>
<role-name>Role2</role-name>
</auth-constraint>
<user-data-constraint id="UserDataConstraint_1">
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<security-role id="SecurityRole_1">
<description>This is Role1</description>
<role-name>Role1</role-name>
</security-role>
<security-role id="SecurityRole_2">
<description>This is Role2</description>
<role-name>Role2</role-name>
</security-role>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/logon.jsp</form-login-page>
<form-error-page>/logonError.jsp</form-error-page>
</form-login-config>
</login-config>
</web-app>
Use the administrative console to administer security for your JAX-RS application.