JAXWS and sessions
I am new to writing web services. I am working on a SOAP service using JAXWS. I want users to be able to log in and my service knows which user is issuing the command. In other words, do some session handling.
One way I've seen is using cookies and HTTP layer access from my web service. However, this affects the use of HTTP as the transport layer (I know that HTTP is almost always transport, but I'm a purist).
Is there a better approach that prevents the service layer from not knowing the transport layer? Is there a way to do this with Servlet Filters? I would like the answer to be as framework agnostic as possible.
a source to share
I am working on a SOAP service using JAXWS. I want users to be able to log in and my service knows which user is issuing the command. In other words, do some session handling.
Regular web services are not stateless in nature, there is no session handling in web services (which is, say, not related to caller identification).
If you want your users to be authenticated to invoke a service, the traditional approach is this:
- Provide an authentication web service (passing user credentials) that returns an authentication token.
- Ask users to trigger this authentication first.
- Ask users to pass the token in the custom header on subsequent calls to "business" web services.
Server side:
- Reject any call that does not contain a valid token.
- Invalid tokens after some time of inactivity
You can implement your own solution for this approach (it is a very interoperable solution). Or you can use WS-Security / UsernameTokens which provides something similar out of the box. WS-Security is a standard (Metro implements it), it is not a "framework".
a source to share
Remember, Servlet Filters can serve as the basis for a solution. Use a filter to store current session data (for example, a contextual session map) in the threadLocal store. This is implemented as your application class, so it is transport agnostic. Your service just uses a static method to retrieve the current context without knowing where it came from.
eg.
class ServiceSessionContext
{
static ThreadLocal<Map> local = new ThreadLocal<Map>();
// context set by the transport layer, e.g. servlet filter
static public void setContext(Map map)
{
local.put(map);
}
// called when request is complete
static public void clearContext()
{
local.put(null);
}
// context fetched by the service
static public Map getContext()
{
return local.get();
}
}
a source to share