Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I have a web application to be developed using RESTeasy API and for this I have to implement security (Form based authentication). So i am not sure about the most appropriate fit for this. As I googled, I found Apache Shiro, Spring Security, etc. Also I have read something about Rest provided authentication jars.

Please help me with this.


My requirements:
1. I should be easily able to use framework with RestEasy API.
2. It should provide authentication and authorization at least

share|improve this question

closed as off-topic by GlenH7, MichaelT, gnat, Martijn Pieters, Robert Harvey Dec 20 '13 at 5:50

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to recommend a tool, library or favorite off-site resource are off-topic for Programmers as they tend to attract opinionated answers and spam. Instead, describe the problem and what has been done so far to solve it." – GlenH7, MichaelT, gnat, Martijn Pieters, Robert Harvey
If this question can be reworded to fit the rules in the help center, please edit the question.

What are your requirements? Rule #1. –  Martijn Verburg Jan 30 '13 at 15:44

1 Answer 1

Use OpenID if you can

This will provide you with a robust mechanism of authentication and you can implement your own internal authorization framework based on whatever you like.

A good solution (as you have identified) is to use Spring Security which comes with all the OpenID integration and method level authorization code out of the box. You might find it a bit overwhelming until you get used to how OpenID works, then it all fits together very well.

Alternatively, you can go for the lightweight approach and use the excellent openid4java library, and implement your own authorization scheme.

I recently wrote a demonstration of OpenID authentication, but it is based on Dropwizard which uses Jersey so is not within your requirements. However it might be helpful for you to see how it all fits together in an uncluttered environment.

Use OAuth2 for proxies

If your web service is expected to act as an authorised third-party to other web services (for example you're writing an app that posts to someone's Twitter account) then you'll need to get on board with OAuth2 instead. This can be quite tricky to get right since many service providers have their own flavours (Facebook, Twitter, Google etc) so you may have a lot more research to do.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.