java - Using one authentication with several web applications inside ear -

i have jsf-based web application uses form-authentication. security-domain set in jboss config. have jax-rs application contains rest-api, , want of methods accessed users whis authenticated in first app.
took on jasig cas seems little heavy purpose , suppose there simpler solution , maybe guys me find it. in advance.

what need can solved oauth.

your backend (rest-api) require authenticated access api operations. in turn, front-end (jsf-based web app) need issue authenticated requests when communicating backend. achieved sending access tokens.

although seem complex, useful take @ stormpath. have quite straightforward solution this. please take @ using stormpath api authentication.

as summary, solution this:

1. you use stormpath java sdk delegate user-management needs.

2. in front, when user presses login button, front end send credentials securely backend-end thorough rest api.

   2.1. way, stormpath enhances possibilities here. instead of having own login page, can delegate login/register functionality stormpath via idsite, or can delegate our servlet plugin. stormpath supports google, facebook, linkedin , github login.

3. your backend try authenticate user against stormpath backend , return access token result:

   /** code throw exception if authentication fails */ public void postoauthtoken(httpservletrequest request, httpservletresponse response) {     application application = client.getresource(applicationresturl, application.class);      //getting authentication result     accesstokenresult result = (accesstokenresult) application.authenticateapirequest(request);      //here can user data stored in stormpath     account account = accesstokenresult.getaccount();      response.setstatus(httpservletresponse.sc_ok);     response.setcontenttype("application/json");      //output json of access token     response.getwriter().print(token.tojson());     response.getwriter().flush(); } 

4. then, every authenticated request, backend do:

   public void getequipment(httpservletrequest request, httpservletresponse response) {     application application = client.getresource(applicationresturl, application.class);      oauthauthenticationresult result = (oauthauthenticationresult) application.authenticateoauthrequest(request).execute();      system.out.println(result.getapikey());     system.out.println(result.getaccount());      //return need return in response     handleequipmentrequest(response); } 

please take here more information

hope helps!

disclaimer, active stormpath contributor.