Simplified Authentication and Authorization for RESTful Services in Trusted Environments

  • Eric Brachmann
  • Gero Dittmann
  • Klaus-Dieter Schubert
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7592)


In some trusted environments, such as an organization’s intranet, local web services may be assumed to be trustworthy. This property can be exploited to simplify authentication and authorization protocols between resource providers and consumers, lowering the threshold for developing services and clients. Existing security solutions for RESTful services, in contrast, support untrusted services, a complexity-increasing capability that is not needed on an intranet with only trusted services.

We propose a central security service with a lean API that handles both authentication and authorization for trusted RESTful services. A user trades credentials for a token that facilitates access to services. The services may query the security service for token authenticity and roles granted to a user. The system provides fine-grained access control at the level of resources, following the role-based access control (RBAC) model. Resources are identified by their URLs, making the authorization system generic. The mapping of roles to users resides with the central security service and depends on the resource to be accessed. The mapping of permissions to roles is implemented individually by the services. We rely on secure channels and the trusted intermediaries characteristic for intranets to simplify the protocols involved and to make the security features easy to use, cutting the number of required API calls in half.


Authentication Authorization Intranet Representational state transfer (REST) Role-based access control (RBAC) Security Web services 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    MIT: Kerberos: The network authentication protocol,
  2. 2.
    Schemers, R., Allbery, R.: WebAuth technical specification,
  3. 3.
    Mazurek, D.: CAS protocol (May 2005),
  4. 4.
    Samar, V.: Single sign-on using cookies for web applications. In: Proceedings of the 8th Intl. Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE 1999), Stanford, CA, USA, pp. 158–163. IEEE (1999)Google Scholar
  5. 5.
    OASIS: SAML specifications,
  6. 6.
    OASIS: OASIS eXtensible Access Control Markup Language (XACML) TC,
  7. 7.
    Mirza, Q.K.A.: Restful implementation of authorization mechanisms. In: Proceedings of the International Conference on Technology and Business Management (ICTBM 2011), Dubai, UAE, pp. 1001–1010. INFOMS (March 2011)Google Scholar
  8. 8.
    Gutzmann, K.: Access control and session management in the HTTP environment. IEEE Internet Computing 5, 26–35 (2001)CrossRefGoogle Scholar
  9. 9.
    Graf, S., Zholudev, V., Lewandowski, L., Waldvogel, M.: Hecate, managing authorization with RESTful XML. In: Proceedings of the 2nd International Workshop on RESTful Design (WS-REST 2011), Hyderabad, India, pp. 51–58. ACM (March 2011)Google Scholar
  10. 10.
    Recordon, D., Reed, D.: OpenID 2.0: A platform for user-centric identity management. In: Proceedings of the 2nd Workshop on Digital Identity Management (DIM 2006), Fairfax, Virginia, USA, pp. 11–16. ACM (November 2006)Google Scholar
  11. 11.
    Hammer-Lahav, E.: The OAuth 1.0 protocol. RFC 5849, IETF (April 2010)Google Scholar
  12. 12.
    Jazz Community: Jazz,
  13. 13.
    ANSI: American national standard for information technology – Role based access control. ANSI INCITS 359-2004, ANSI (February 2004)Google Scholar
  14. 14.
    Zukowski, M.: RubyCAS-Server,

Copyright information

© Springer-Verlag Berlin Heidelberg 2012

Authors and Affiliations

  • Eric Brachmann
    • 1
  • Gero Dittmann
    • 2
  • Klaus-Dieter Schubert
    • 2
  1. 1.Dresden University of TechnologyDresdenGermany
  2. 2.IBM Systems & Technology GroupBoeblingenGermany

Personalised recommendations