Single Sign on to secure REST APIs and internal we

问题:

I need some suggestions on how to secure REST APIs and web based internal system using a single authentication system.

I am looking into the possibility of using:

1. oAuth 2.0
2. JA-SIG CAS
3. Custom Implementation (implement two separate APIs)
   1. To secure REST APIs and redirect calls to specific API instance
   2. To authenticate web application users.

回答1:

I assume you have a UI for your webapp and want to share your identity between your webapp and your web service. You can achieve that by :

1. "cassifying" your webapp (For example : https://wiki.jasig.org/display/CASC/Configuring+the+Jasig+CAS+Client+for+Java+in+the+web.xml)
2. proxifying your calls from your webapp to your web service (https://wiki.jasig.org/display/CAS/Proxy+CAS+Walkthrough).

回答2:

Here are a few suggestions in how to secure REST APIs. They are related to iPhones but they are generally applicable to client/server REST API implementations. Without more information I don't know how applicable they are, but they might help you out a bit:

Security When Using REST API in an iPhone Application

https://stackoverflow.com/questions/15390354/api-key-alternative/15390892#15390892