18.5. JAX-RS Application Security

Procedure 18.5. Enable Role-Based Security for a RESTEasy JAX-RS Web Service

1. Open the web.xml file for the application in a text editor.
2. Add the following <context-param> to the file, within the web-app tags:

   <context-param>
       <param-name>resteasy.role.based.security</param-name>
       <param-value>true</param-value>
   </context-param>
   

3. Declare all roles used within the RESTEasy JAX-RS WAR file, using the <security-role> tags:

   <security-role>
       <role-name>ROLE_NAME</role-name>
   </security-role>
   <security-role>
       <role-name>ROLE_NAME</role-name>
   </security-role>

4. Authorize access to all URLs handled by the JAX-RS runtime for all roles:

   <security-constraint>
       <web-resource-collection>
   	<web-resource-name>Resteasy</web-resource-name>
   	<url-pattern>/PATH</url-pattern>
       </web-resource-collection>
       <auth-constraint>
   	<role-name>ROLE_NAME</role-name>
   	<role-name>ROLE_NAME</role-name>
       </auth-constraint>
   </security-constraint>

Procedure 18.6. Secure a JAX-RS Web Service using Supported Security Annotations

1. Enable role-based security. For more information, refer to: Section 18.5.1, “Enable Role-Based Security for a RESTEasy JAX-RS Web Service”
2. Add security annotations to the JAX-RS web service. RESTEasy supports the following annotations:

   @RolesAllowed

   Defines which roles can access the method. All roles should be defined in the web.xml file.

   @PermitAll

   Allows all roles defined in the web.xml file to access the method.

   @DenyAll

   Denies all access to the method.