Announcement Announcement Module
No announcement yet.
Authentication with JAXB or SOAP Page Title Module
Move Remove Collapse
Conversation Detail Module
  • Filter
  • Time
  • Show
Clear All
new posts

  • Authentication with JAXB or SOAP


    i develop a modular webapp. One part of this is a JSF-webapp, the frontend, contains only views with controller and a service-layer (REST-client and SOAP-client) , running on Jboss. Another part, the backend, provides webservices (REST-server, SOAP-services) and hold's the connection to the database. Frontend dont have possibility to connect to a database.

    My question/problem:

    Authentication has to perform from a Login-Page (Frontend) via REST-service or SOAP to the backend. Backend has to connect to database, to check the credentials and to response the result to the frontend and store in session. In a single webapp it is not the problem. There i use a security-config.xml like this :

     <security:http auto-config="true">
                  <security:form-login login-page="/app/main" default-target-url="/app/account" />
                  <security:logout logout-url="/app/logout" logout-success-url="/app/main" />
                  <security:authentication-provider user-service-ref="userService">
                      <security:password-encoder ref="encoder" />
              <bean id="daoAuthenticationProvider" class="">
                  <property name="userDetailsService" ref="userService" />
                  <property name="hideUserNotFoundExceptions" value="false" />        
              <bean id="authenticationManager" class="">
                      <ref bean="daoAuthenticationProvider" />
      <bean id="encoder" class="">
           <constructor-arg value="512"/>
    in bean.xml :

     <bean id="userAuthenticationProviderService" class="">
              <property name="authenticationManager" ref="authenticationManager" />
    and a java class :

    private AuthenticationManager authenticationManager;
        public AuthenticationManager getAuthenticationManager() {
            return authenticationManager;
        public void setAuthenticationManager(AuthenticationManager authenticationManager) {
            this.authenticationManager = authenticationManager;
         * {@inheritDoc}
        public boolean processUserAuthentication(UserEntity user) {
            try {
                Authentication request = new UsernamePasswordAuthenticationToken(user.getUserName(), user.getPassword());
                Authentication result = authenticationManager.authenticate(request);
                return true;
            } catch (AuthenticationException ex) {
                FacesContext.getCurrentInstance().addMessage(null, new FacesMessage(FacesMessage.SEVERITY_ERROR, ex.getMessage(), "Sorry"));
                return false;
    I dont know how i get it working via JAXB or SOAP. For example:

    Backend REST class :

     public class UserAuthServiceImpl implements RestUserAuthService {
          public Response login(final String xmlRequestString) {
              Request request = JAXB.unmarshal(xmlRequestString, Request.class);
              UserAuthRequest userAuthRequest = request.getAuthRequest(); // contains username and password
              UserAuthUtil util = new UserAuthUtilImpl();
              UserAuthResponse userAuthResponse = util.login(userAuthRequest); 
              Response response = new Response();
              return response;
    and in the UserAuthUtilImpl class:

          public UserAuthResponse login(final UserAuthRequest userAuthRequest) {        
              String username = userAuthRequest.getUsername();
              String password = userAuthRequest.getPassword();        
              UserAuthResponse userAuthResponse = new UserAuthResponse();
              userAuthResponse.setSuccess(authenticate(username, password));
              return userAuthResponse;
      private boolean authenticate(final String username, final String password) {
              Authentication auth = new UsernamePasswordAuthenticationToken(username, password);
              Authentication authResult = authenticationManager.authenticate(auth);        
              boolean success = authResult.isAuthenticated();
              return success;
    backend dont need (i think so) in security-config.xml:

    [CODE] <security:http auto-config="true">
    <security:form-login login-page="/app/main" default-target-url="/app/account" />
    <security:logout logout-url="/app/logout" logout-success-url="/app/main" />

    If i understand right Spring Security, if an user is authenticated successfully, user-credentials are stored in session. But how do i put the credentials in the session if i get only true or false from backend, because i cant store SecurityContextHolder via JAXB from backend to frontend?