ACEGI Authentication for a RESTful service

[nvmurali]

This is may be glaringly obvious but -

I want to write an API framework that will provide data to the outside world in XML format, as long as they are authenticated (like the Google API).

Is this possible with ACEGI? What do I have to do.

I'm really a novice when it comes to web services, but if you can point me in the right direction - hopefully I'll get it sooner than later.

Thanks,

Murali

[lowerymb77]

While there isn't a section specifically for web services in the Acegi Security reference, all the pieces are there. See the Filters section.

<bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy">
  <property name="filterInvocationDefinitionSource">
    <value>
      CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
      PATTERN_TYPE_APACHE_ANT
      /webServices/**=httpSessionContextIntegrationFilterWithASCFalse,basicProcessingFilter,exceptionTranslationFilter,filterSecurityInterceptor
      /**=httpSessionContextIntegrationFilterWithASCTrue,authenticationProcessingFilter,exceptionTranslationFilter,filterSecurityInterceptor
    </value>
  </property>
</bean>

Notice the separate filter chain for web services? When a request comes in matching /webServices, Basic authentication is required. You can also use Digest authentication.