Security REST service using web.xml

In the Using JPA in REST web application deployed in Jetty entry i talked about how to create a REST service which uses JPA to interact with database. This service allows you to list, insert, update and delete records from CONTACT table. When you create a service that allows you to update your back end you might want to protect it so that only authorized user can update the database. I wanted to figure out how to protect the service so that every user can get list of contacts but only ADMIN user is able to modify the contacts by inserting, updating and deleting them. YOu can download the sample application that i developed from here When the user tries to insert a new record he will get prompted for basic authentication like this I followed these steps to build the sample application

1. First i did download the basic ManageContactApp.zip that provides REST interface and i tested it to make sure that it works
2. Next i used the instructions in Securing web application deployed in Jetty to make changes in Maven build file(pom.xml) to enable loginService in Jetty

   
   <build>
     <finalName>JettySecurity</finalName>
     <plugins>
       <plugin>
         <groupId>org.mortbay.jetty</groupId>
         <artifactId>jetty-maven-plugin</artifactId>
         <version>7.4.5.v20110725</version>
         <configuration>
           <scanIntervalSeconds>10</scanIntervalSeconds>
           <webAppConfig>
             <contextPath>/JettySecurity</contextPath>
           </webAppConfig>
           <loginServices>
             <loginService implementation="org.eclipse.jetty.security.HashLoginService">
               <name>Default</name>
               <config>${basedir}/src/main/resources/realm.properties</config>
             </loginService>
           </loginServices> 
           <connectors>
             <connector implementation="org.eclipse.jetty.server.nio.SelectChannelConnector">
               <port>9000</port>
               <maxIdleTime>60000</maxIdleTime>
             </connector>
           </connectors>
         </configuration>
       </plugin>
     </plugins>
   </build>
   

3. Next create realm.properties file in ${basedir}/src/main/resources directory which looks like this

   
   guest:guest
   admin:admin,ADMIN
   

   This file has only 2 users first is guest and second is admin the admin user has ADMIN role.
4. The next step is to make changes in web.xml to protect the appropriate HTTP method calls in web.xml like this

   
   <!DOCTYPE web-app PUBLIC
    "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
    "http://java.sun.com/dtd/web-app_2_3.dtd" >
   
   <web-app>
     <display-name>Archetype Created Web Application</display-name>
     <servlet>
       <servlet-name>Jersey Web Application</servlet-name>
       <servlet-class>
   	com.sun.jersey.spi.container.servlet.ServletContainer</servlet-class>
       <init-param> 
             <param-name>javax.ws.rs.Application</param-name> 
             <param-value>
   		  com.webspherenotes.rest.ContactApplication</param-value> 
       </init-param>
       <load-on-startup>1</load-on-startup>
     </servlet>
     <servlet-mapping>
       <servlet-name>Jersey Web Application</servlet-name>
       <url-pattern>/rest/*</url-pattern>
     </servlet-mapping>
   
   
     <security-constraint>
       <web-resource-collection>
         <web-resource-name>Create Contact</web-resource-name>
         <url-pattern>/rest/*</url-pattern>
         <http-method>POST</http-method>
         <http-method>PUT</http-method>
         <http-method>DELETE</http-method>
       </web-resource-collection>
       <auth-constraint>
         <role-name>ADMIN</role-name>
       </auth-constraint>
     </security-constraint>
   
     <login-config>
       <auth-method>BASIC</auth-method>
       <realm-name>Default</realm-name>
     </login-config>
   
     <security-role>
       <role-name>ADMIN</role-name>
     </security-role>
   
   </web-app>
   

   The most important change in web.xml is defining the security constraints for the /rest URL, which is the base URL for the REST service. The security constraint says that only allow those users who have ADMIN role access to POST, PUT, DELETE HTTP methods on this URL. The login-config element says that use Basic authentication

Now run the web application by executing mvn jetty:run and you will notice that you can get list of contacts but when you try to either insert a new contact or delete existing contact then you will get prompted for userid and password