9 ReST Services Security Consideration

The chapter provides the details on how to setup security for Representational State Transfer (ReST) Services.

The following topics are covered in this chapter:

• Understanding the Security Model

• One Way SSL - ReST Services

One Way SSL

With one-way SSL, the server is required to present a certificate to the client but the client is not required to present a certificate to the server. To successfully negotiate an SSL connection, the client must authenticate the server, but the server will accept a connection from any client. One-way SSL is common on the Internet where customers want to create secure connections before they share personal data. Often, clients will also use SSL to log on in order for the server can authenticate them.

ReST Committee recommends the use of one way SSL over ReST Services for 14.1.

One Way SSL - ReST Services

Figure 9-1 One way SSL: ReST Services

See the following sequence:

1. ADF Mobile Security Set at the Mobile Client Level to Allow Authentication.

2. ADF Mobile Client Injects Authorization Header for Every Service Call (configuration changes).

3. J2EE based Basic Authentication (SSL) is configured in the ReST Service Web Application Descriptor to allow secure connectivity to ReST Service.