[[Jakarta-XML-Web-Services-Authentication]]
= Authentication

ifdef::env-github[]
:tip-caption: :bulb:
:note-caption: :information_source:
:important-caption: :heavy_exclamation_mark:
:caution-caption: :fire:
:warning-caption: :warning:
endif::[]

[[Jakarta-XML-Web-Services-authentication]]
== Authentication

Here the simplest way to authenticate a web service user with JBossWS is
explained.

First we secure the access to the SLSB as we would do for normal (non
web service) invocations: this can be easily done through the
@RolesAllowed, @PermitAll, @DenyAll annotation. The allowed user roles
can be set with these annotations both on the bean class and on any of
its business methods.

[source,java,options="nowrap"]
----
@Stateless
@RolesAllowed("friend")
public class EndpointEJB implements EndpointInterface
{
  ...
}
----

Similarly POJO endpoints are secured the same way as we do for normal
web applications in web.xml:

[source,xml,options="nowrap"]
----
<security-constraint>
  <web-resource-collection>
    <web-resource-name>All resources</web-resource-name>
    <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <auth-constraint>
    <role-name>friend</role-name>
  </auth-constraint>
</security-constraint>

<security-role>
  <role-name>friend</role-name>
</security-role>
----

[[specify-the-security-domain]]
=== Specify the security domain

Next, specify the security domain for this deployment. This is performed
using the `@SecurityDomain` annotation for EJB3 endpoints

[source,java,options="nowrap"]
----
@Stateless
@SecurityDomain("JBossWS")
@RolesAllowed("friend")
public class EndpointEJB implements EndpointInterface
{
  ...
}
----

or modifying the jboss-web.xml for POJO endpoints

[source,xml,options="nowrap"]
----
<jboss-web>
<security-domain>JBossWS</security-domain>
</jboss-web>
----

The security domain as well as its the authentication and authorization
mechanisms are defined differently depending on the application server
version in use.

[[use-bindingprovider-to-set-principalcredential]]
=== Use BindingProvider to set principal/credential

A web service client may use the `jakarta.xml.ws.BindingProvider`
interface to set the username/password combination

[source,java,options="nowrap"]
----
URL wsdlURL = new File("resources/jaxws/samples/context/WEB-INF/wsdl/TestEndpoint.wsdl").toURL();
QName qname = new QName("http://org.jboss.ws/jaxws/context", "TestEndpointService");
Service service = Service.create(wsdlURL, qname);
port = (TestEndpoint)service.getPort(TestEndpoint.class);

BindingProvider bp = (BindingProvider)port;
bp.getRequestContext().put(BindingProvider.USERNAME_PROPERTY, "kermit");
bp.getRequestContext().put(BindingProvider.PASSWORD_PROPERTY, "thefrog");
----

[[using-http-basic-auth-for-security]]
=== Using HTTP Basic Auth for security

To enable HTTP Basic authentication you use the `@WebContext` annotation
on the bean class

[source,java,options="nowrap"]
----
@Stateless
@SecurityDomain("JBossWS")
@RolesAllowed("friend")
@WebContext(contextRoot="/my-cxt", urlPattern="/*", authMethod="BASIC", transportGuarantee="NONE", secureWSDLAccess=false)
public class EndpointEJB implements EndpointInterface
{
  ...
}
----

For POJO endpoints, we modify the _web.xml_ adding the auth-method
element:

[source,xml,options="nowrap"]
----
<login-config>
  <auth-method>BASIC</auth-method>
  <realm-name>Test Realm</realm-name>
</login-config>
----

