The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

Examples: SecuringWeb Applications
882
In general, the following steps are necessary to add basic authentication to a JAX-WS web
service. In the example application included with this tutorial, many of these steps have been
completed for you and are listed here simply to show what needs to be done should you wish to
create a similar application.
1. Create an application like the one in “Creating a Simple Web Service and Client with
JAX-WS” on page 478. The example in this tutorial starts with that example and
demonstrates adding basic authentication of the client to this application. The completed
version of this application is located in the directories
tut-install/javaeetutorial5/examples/jaxws/helloservice-basicauth and
tut-install/javaeetutorial5/examples/jaxws/simpleclient-basicauth.
2. If the port value was set to a value other than the default (8080), follow the instructions in
“Setting the Port” on page 478 to update the example files to reflect this change.
3. If you have not already done so, follow the steps in “Building the Examples” on page 69 for
information on setting up your system to run the example.
4. If you have not already done so, add a user to the file realm and specify user for the group
of this new user. Write down the user name and password so that you can use them for
testing this application in a later step. If you have not already completed this step, refer to the
section “Managing Users and Groups on the Application Server” on page 779 for
instructions.
5. Modify the source code for the service, Hello.java, to specify which roles are authorized to
access the sayHello (String name) method. This step is discussed in “Annotating the
Service” on page 882.
6. Add security elements that specify that basic authentication is to be performed to the
application deployment descriptor, web.xml. This step is discussed in “Adding Security
Elements to the Deployment Descriptor” on page 883.
7. Modify the runtime deployment descriptor, sun-web.xml, to map the role used in this
application (basicUser) to a group defined on the Application Server (user). This step is
discussed in “Linking Roles to Groups” on page 884.
8. Build, package, and deploy the web service. See “Building and Deploying helloservice
with Basic Authentication Using NetBeans IDE” on page 885 or “Building and Deploying
helloservice with Basic Authentication Using Ant” on page 886 for the steps to accomplish
this.
9. Build and run the client application. See “Building and Running the helloservice Client
Application with Basic Authentication Using NetBeans IDE” on page 886 or “Building and
Running the helloservice Client Application with Basic Authentication Using Ant” on
page 887 for the steps to accomplish this.
Annotating the Service
In this example, annotations are used to specify which users are authorized to access which
methods of this service. In this simple example, the @RolesAllowed annotation is used to
The Java EE 5Tutorial • June 2010