Project: talendesb
Issue TESB-2971: Authentication for Data Services
As a data service designer / administrator I want to secure my data services to only allow authenticated user to invoke the service. h4. Goal The goal is to enable user in ESB Studio to specify which kind of authentication he requires for the data service (client and provider) if any. For the client user can either select non secured, user name / pasword or SAML Token. For the provider user can either select non secured, user name / pasword, SAML Token or both. h4. How to provide authentication based on user name password On the client side user name and password are specified via the context of the data service. Talend runtime needs a way to pass these credentials to CXF. On the provider side user name password combination is validated using Karaf's JAAS modules. Talend runtime needs to provide handler that given the information from CXF validates it using the JAAS modules. h4. How to provide authentication based on SAML token Here it is assumed that an STS is available. Authentication to the STS is done via user name / password taken from the context, on the provider side validation is done against STS certificate stored in local keystore. h4. Additional things to do - Specify security policies for user name / password and SAML token, include them in Karaf in some dedicated directory, so they can be referenced from within the WSDL. - For all scenarios specify corresponding spring configuration that is required to sucessfully run the services. - Include bundles in Karaf container and activate by default. - Provide documentation how to configure Karaf JAAS modules and how to add STS certificate to keystore
Story points: 8