Custom SignIn & SignUp on RESTlet + GAE/J?

Question

I am currently working on a small project using RESTlet on Google App Engine/Java.

I was searching.. searching.. and couldn't find the exact or understandable solutions for my doubts.

My question is that How am I suppose to implement my own SignIn & SignUp module without using google's UserService or Spring Security??

Is there any actual sample code available??

I mean SignUp part is just a simple JDO insert & select module. let's just say I've done it.

How am I supposed to handle each user's request session and authentication??

I am thinking about using HTTPS on every request.

Any suggestions or help would be really appreciated!

Thanks in advance.

Answer 1

In Restlet, you have security support on both client and server sides. On client side, you can specify security hints using the ChallengeResponse entity. This feature is open and you can specify the authentication type you want. In the following code, I use an http basic authentication based on username / password:

ClientResource cr = new ClientResource(uri);
ChallengeScheme scheme = ChallengeScheme.HTTP_BASIC; 
ChallengeResponse authentication = new ChallengeResponse(
                          scheme, "username", "password"); 
cr.setChallengeResponse(authentication);

Restlet will automatically build necessary headers in the corresponding request. You can note that Restlet supports a wide range of authentication types through its extensions. I know that some work is done at the moment to support OAuth v2 (see http://wiki.restlet.org/developers/172-restlet/257-restlet/310-restlet.html).

On the server side, you need to secure accesses at routing level using the ChallengeAuthenticator entity, as described below. This can be done within your Restlet application:

public Restlet createInboundRoot() {
    Router router = new Router(getContext());

    ChallengeAuthenticator guard = new ChallengeAuthenticator(getContext(),
                                         ChallengeScheme.HTTP_BASIC, "realm");
    guard.setVerifier(verifier);
    guard.setEnroler(enroler);

    guard.setNext(router);
    return guard;
}

Like for client side, this support is generic and is based on two interfaces that need to be specified on the guard:

• The verifier one to check if authentication is successful
• The enroler one to fill roles for the authenticated user

You can notice that same security technologies need to be use on both sides...

If you want to manage authentication session for user, you need to implement it by yourself using cookies.

When authentication successes on server side, you can return a cookie containing a security token that allows you checking the user from your database (for example). Some code like below can implement that:

CookieSetting cookie = new CookieSetting(0,
                 SECURITY_COOKIE_NAME, securityToken);
Series<CookieSetting> cookieSettings = response.getCookieSettings();
cookieSettings.clear();
cookieSettings.add(cookie);

You can extend for example the SecretVerifier class of Restlet to add a test on security data received and add this code when receiving the security cookie.

On client side, you need to add hints for authentication the first time and then re send the security cookie following times, as described below:

ClientResource clientResource = (...)
(...)
Cookie securityCookie = new Cookie(0,
             SECURITY_COOKIE_NAME, securityToken);
clientResource.getRequest().getCookies().clear();
clientResource.getRequest().getCookies().add(securityCookie);

Hope it will help you! Thierry

Answer 2

If you are interested in re-using social accounts, you need to integrate with each one like facebook oauth

And/Or use the app engine authentication via OpenID

Both ways define an API to authenticate a client, you can use the UserService or manage your own state via cookies.