Our application consists of multiple OSGi bundles, which expose their functionality through RESTful URIs. What is the best way to secure these URIs, so that only logged in and authorized users can access them? For a normal web application, I’d have used a web filter to control the access to all these URIs. Is there a way I can secure the access using just one security filter (or its equivalent) for all these URIs in OSGi? Or, will I need to include the security filter in each of the OSGi bundles? The container we are using is Apache Karaf, if it matters.
Our application consists of multiple OSGi bundles, which expose their functionality through RESTful URIs.
Share
The Apache Felix Http Jetty service includes a filter facility. The easiest way to use it is to install the Apache Felix Http Whiteboard bundle and then register a Filter service …
Unfortunately, this is not in the OSGi spec yet but will likely become part of the spec for the next round. I’ve been using this model for exactly your type of security now for 6 months and it works like a charm.