java - Jersey-request for authentication

Question

I have a working JavaEE 6 web application on Glassfish, this application already has a JSF frontend and has its authentication mechanism((Using CDI and annotation based security) So there is a login screen, user enters username password, press login button and Java EE authentication process begins.

Now I want to "also" expose some of my service classes as a REST service (I will use Jersey probably), so it can also be reached from a mobile device. But what worries me is the login part.

I will use the exact same existing authentication But now I want my application will get this credentials from a Rest Request but not from the login screen. And then continue using the existing validation methods which already exists(check username password from DB,,etc)

I kinda got lost how can I do this, I think I need to use one of these filters to intercept the request and get the username password but not sure how and which one? Or I dont need anything like this?

Answer 1

You can protect the REST service the same way you protect the REST service, for example:

@Path("/foo")
@RolesAllowed({"admin", "customer"})
public class Foo {

@GET

@Produces("text/plain")
@RolesAllows("admin")
public void adminOnly() {}

public void adminOrCustomer() {}

}

I guess you already have roles and mappings for them so just use the same roles you got, the application server will take care of the rest.