Web Service Authentication using OpenID

Question

I\'m going to be developing a REST-ful Web Service for a new public website. The idea behind the web service is to have 3rd parties develop fully functional UIs for the busi

Answer 1

We have been working on a project to integrate OpenID Authentication for SOAP web services. You can find our project at http://code.google.com/p/ws-sandhana/.

You can provide Single Sing On to your web services using OpenID authentication and you can enforce the trusted OpenID Providers and required attributes of the users by defining service security policies.

This is an open source implementation on Apache Rampart which is the security module for Apache Axis2 web service engine. You can find our blog at http://sandhana-project.blogspot.com/ for more information.

Answer 2

I agree completely that what you want is OAuth; I say that having worked on both OAuth and OpenID systems. I've also been in your boat a few times, having to develop a REST web service api.

For a really good ideas on OAuth, and why it is what you want see these attached article:

These are must read, there are four parts read them all: http://hueniverse.com/oauth/guide/

the RFC, read after reading above as it can be a little daunting for most: http://oauth.net/core/1.0

And then finally maybe some code. I have a couple projects hosted that are using Java/Groovy to do OAuth. One is a plain old OAuth client, the other is a client for specific interactions with NetFlix. http://www.blueleftistconstructor.com/projects/

If you are relatively inexperienced with REST (you haven't built a full scale web api yet) I would recommend that you buy (or better get your boss to) "RESTful Web Services" by Richardson & Ruby. It is an O'Reilly book. I can say that it is one of their better books to debut in the past few years.

It might also help to look at some RESTful OAuth based APIs. The NetFlix API is a perfect example: http://developer.netflix.com/docs

Good luck and happy coding!

Answer 3

So far, I've found 1 worthwhile link:

http://markmail.org/message/utf7js473zqv45hv

This conversation mentions something called "OpenID Exchange" which is right up my alley... but the included link is broken and there's not much solid information on Google for it.

Looks like OAuth might be the ticket: http://oauth.net/