Call REST service while impersonating a user that is already authorized to the glasfish server
- by user1894489
There are two web-applications deployed on a glassfish server.
Both web applications provide a REST web service.
the access to both web-services is secured via glassfish security constraints (at the moment BASIC Auth and file-realm).
Let's say a user is accessing the service of web application A. After he is authorized, service A wants to call service B via REST client.
Is there a way for a service to impersonate a user that is already authorized to the glasfish server? Maybe something like forwarding the security context or editing the headers? Is there another Filter?
@Context
private SecurityContext securityContext;
username = securityContext.getUserPrincipal().getName();
password = ???
client.addFilter(new com.sun.jersey.api.client.filter.HTTPBasicAuthFilter(username, password));
Thanks!
