title: DropWizard Auth by Example
body: <p>I'm trying to understand how authentication and authorization work in <a href="https://dropwizard.github.io/dropwizard/index.html" rel="noreferrer">DropWizard</a>. I've read their <a href="https://dropwizard.github.io/dropwizard/manual/auth.html" rel="noreferrer">auth guide</a> as well as the <a href="https://github.com/stevenalexander/dropwizard-security" rel="noreferrer">dropwizard-security</a> project on GitHub, but feel like I'm still missing a few important concepts.</p>
  
  <pre><code>public class SimpleCredential {
      private String password;
  
      public SimpleCredential(String password) {
          super();
  
          this.password = password;
      }
  }
  
  public class SimplePrincipal {
      pivate String username;
  
      public SimplePrincipal(String username) {
          super();
  
          this.username = username;
      }
  }
  
  public class SimpleAuthenticator implements Authenticator&lt;SimpleCredential, SimplePrincipal&gt; {
      @Override
      public Optional&lt;SimplePrincipal&gt; authenticate(SimpleCredential credential) throws AuthenticationException {
          if(!"12345".equals(credential.getPassword())) {
              throw new AuthenticationException("Sign in failed.");
          }
  
          Optional.fromNullable(new SimplePrincipal("simple_user"));
      }
  }
  </code></pre>
  
  <p>And then in my <code>Application</code> subclass:</p>
  
  <pre><code>@Override
  public void run(BackendConfiguration configuration, Environment environment) throws Exception {
      environment.jersey().register(new BasicAuthProvider&lt;SimplePrincipal&gt;(new SimpleAuthenticator(), "SUPER SECRET STUFF"));
  }
  </code></pre>
  
  <p>And then in a resource method:</p>
  
  <pre><code>@GET
  @Path("address/{address_id}")
  @Override
  public Address getAddress(@Auth @PathParam("address_id") Long id) {
      addressDao.getAddressById(id);
  }
  </code></pre>
  
  <p>I think I have this half-configured correctly for basic auth, but not understanding the role that <code>SimpleCredential</code> and <code>SimplePrincipal</code> play. Specifically:</p>
  
  <ol>
  <li>How do I set basic auth username/password from the Jersey/JAX-RS client?</li>
  <li>What role do <code>SimpleCredential</code> and <code>SimplePrincipal</code> play with basic auth? Do I need to add anything to them or other classes to make basic auth work such that the only valid username is <code>simple_user</code> and the only valid password is <code>12345</code>?</li>
  <li>How do I enforce access/authroization/roles via <code>SimplePrincipal</code>? Or is the concept of authorization non-existent with web services?</li>
  </ol>