https://answers.axonivy.com/questions/1858/rest-service-security<p>Hello All,</p> <p>What is the security context of the new REST services ? How to get/check the user that is consuming them ?</p> <p>Thanks a lot !</p> <p>Best Regards, Yordan Yunchov</p>enMon, 04 Jul 2016 15:30:15 -0400https://answers.axonivy.com/questions/1858/rest-service-security#1861<p>Thanks Reto !</p>Stelt0Mon, 04 Jul 2016 15:30:15 -0400https://answers.axonivy.com/questions/1858/rest-service-security#1861https://answers.axonivy.com/questions/1858/rest-service-security/1860<p>The REST service provided by Axon.ivy are be default protected by HTTP BASIC Authentication. We suggest that you use https to communicate with the provided services since HTTP BASIC sends passwords in cleartext. All Axon.ivy users of an application can be used to authenticate against the REST service.</p> <p>Since 6.4 you can customize the security for each service or even on single methods:</p> <ul> <li><code>@javax.annotation.security.PermitAll</code>: allows unauthenticated access to anonymous users</li> <li><code>@javax.annotation.security.RolesAllowed</code>: users must be authenticated and own the defined roles</li> <li><code>@javax.annotation.security.DenyAll</code>: nobody is allowed to invoke this service</li> <li>See the <strong>SecureService</strong> in the <strong>ConnectivityDemos</strong> for a demo:</li> <li>Or look at the Jersey chapter about secure annotations. <a href="https://jersey.java.net/documentation/latest/security.html#annotation-based-security">https://jersey.java.net/documentation/latest/security.html#annotation-based-security</a></li> </ul> <p><img alt="alt text" src="http://answers.axonivy.com/upfiles/secureRestService.PNG"></p>Reto WeissMon, 04 Jul 2016 15:24:18 -0400https://answers.axonivy.com/questions/1858/rest-service-security/1860