We have come across two apps made on google app engine (java) and we need to establish a secure communication between then. Basically we have:
APP1: “Public” APP that provides data in JSON format based on requests in JSON format. The data is private, subject just to the specific request.
APP2: “Internal/Not public” APP that request data to APP1 in JSON format and needs to receive response in JSON format.
The scenario above is working fine, we have both apps communicating between each other. However, we need this communication to be secure and we need to identify (authorization and authentication process) that is really the APP2 that is requesting data to the APP1.
We have thought of many approaches but we haven’t come across a final solution, I was hoping someone has implemented something similar.
1) We thought about using oAuth, building a “Provider APP” and making APP2 subscribing to our APP1 through this provider. The reason for us to have look at this solution, it’s that maybe in future we will allow a third party app (APP3) to consume the data from APP1 in a subscription mode.
Regards.
This functionality is now built into the App Engine API. Apps can securely assert their identity to other apps.
ref:
http://code.google.com/appengine/docs/java/appidentity/overview.html#Asserting_Identity_to_Other_Systems