REST API authentication with SAML

java rest session saml saml-2.0
Nereis picture Nereis · Oct 18, 2013 · Viewed 29.3k times · Source

I'm struggling to design a SAML2.0 authentication for a REST API using a gateway. REST is used between my backend and my application. I'm using Java Servlet filter and Spring.

I see two possibilities:

  1. Adding the SAML tokens into the header each time.

  2. Authenticate once with SAML, then using a session or similar (secure conversation) between the client and the gateway.

Case 1: It's a good solution because we are still RESTful but:

  • SAML tokens are quite big. It's may generated problem due to big header size.
  • Replaying tokens is not the best way for security concern.

Case 2: It's no more stateless and I have to managed a link with the client. Since I use a gateway, the underlying services can still be RESTful.

Case 2 looks for the better choice despite the fact that it does not follow the rest constraints.

Is someone had already to do it and give me some pointers (for design or implementation)?

Is there a better way to do it with SAML?

Any help or advice are welcome.

Answer

Zelgada picture Zelgada · Oct 21, 2013

It is still draft, but: the OAuth2 SAML bearer profile may a possible solution. http://tools.ietf.org/html/draft-ietf-oauth-saml2-bearer-17

Use a SAML2 to authenticate to an OAuth2 provider, then call your service with the OAuth2 token.

Related questions

Main differences between SOAP and RESTful web services in Java

For now I have a slight idea about the differences between SOAP and RESTful services. My question is when I should use SOAP, and when I should use RESTful; which one is "better" when it comes to performance/speed or …

Read More
JAX-RS — How to return JSON and HTTP status code together?

I'm writing a REST web app (NetBeans 6.9, JAX-RS, TopLink Essentials) and trying to return JSON and HTTP status code. I have code ready and working that returns JSON when the HTTP GET method is called from the client. Essentially: @Path("…

Read More
RESTful call in Java

I am going to make a RESTful call in Java. However, I don't know how to make the call. Do I need to use the URLConnection or others? Can anyone help me. thank you.

Read More