title: JAX-WS, Authentication and Authorization - How to?
body: <p>What is the best way to do authentication and authorization in web services?</p>
  
  <p>I am developing a set of web services, requiring role based access control.
  Using metro - SOAP, simple java without EJBs.</p>
  
  <ul>
  <li>I want to Authenticate the user just one time, using username and
  password, to be matched against a data base. In the subsequent calls.</li>
  <li>I would like to use some kind of session management. Could be some
  session id, retrieved to the client at login, to be presented in all
  calls.</li>
  </ul>
  
  <p>So Far:</p>
  
  <ul>
  <li>Read <a href="https://stackoverflow.com/questions/1613212/jax-ws-and-basic-authentication-when-user-names-and-passwords-are-in-a-database"> authentication using a database</a>  - but I want application level validation;
  <br/></li>
  <li><p>Read <a href="http://www.mkyong.com/webservices/jax-ws/application-authentication-with-jax-ws/" rel="nofollow noreferrer">application authentication with jax-ws</a> - but i don't want to do the authentication mechanism every time;</p></li>
  <li><p>I think I can use a SOAP Handler, to intercept all the messages, and do the authorization control in the hander, using some session identifier token, that comes with the message, that can be matched against an identifier saved in the data base, in the login web method.</p></li>
  </ul>
  
  <p><strong>EDIT:</strong></p>
  
  <p>I still have some questions:</p>
  
  <ul>
  <li>How to know the name of the web method being called?</li>
  <li>What kind of token should I use?</li>
  <li>How to pass this token between calls?</li>
  </ul>
  
  <p><strong>EDIT 2</strong></p>
  
  <p>Because of @ag112 answer:</p>
  
  <p>I'm using Glassfish.</p>
  
  <p>I use WS-Policy and WS-Security to encrypt and sign the messages. Using Mutual Certificate Authentication. I would like to complement this message level security between applications, with the authentication and authorization for the users also in message level. </p>
  
  <p>I am just developing the services, and I don't know almost nothing the clients, just that they could be created in different languages.</p>
  
  <p>At this point I think the most important thing is to do what ever I need to do to authenticate and authentication the users, I the most easy way to be implemented for the client applications.</p>