Question

I have followed the article here http://chrisdail.com/2008/08/13/http-basic-authentication-with-apache-cxf-revisited/

I now have a working interceptor for my soap service that wont let the services be used without the username and password.

I have a couple of questions though:

1. How can I, in a different package in my business logic, access the authorisation object to find out who is logged in and their roles?

2. How can I attached the same system to a rest service, is it possible or do I need to do it separatley?

Cheeers,
Rob

Answer 1

From within the service, you can do something like:

PhaseInterceptorChain.getCurrentMessage().get(AuthorizationPolicy.class);

to get the AuthorizationPolicy and use that for whatever actions you need.