ApacheCon EU 2014

OAuth2 is a set of specifications describing the way resource owners can allow third party applications access some of their resources. OAuth2 owes a lot to the popularity of older OAuth1, the fact which led to the OAuth2 process being initiated. However the concern about OAuth2 being as capable and secure as OAuth1 is still shared by some developers. In this presentation we will briefly introduce Apache CXF OAuth2 implementation and show how OAuth2 and Hawk (Mac) token can be used to create simpler and no less secure classical OAuth applications.

JAX-RS specification makes creation of REST services easy and intuitive for Java developers. However there are a number of topics to worry about in order to provide clean and maintainable REST APIs.
In this presentation, Andrei will share practical experience to design REST services based on JAX-RS Apache CXF implementation.
The presentation will cover the following:
- Exposing of resources and collections
- Resource methods selection and content negotiation
- Exception processing
- Client and Server asynchronous APIs
- Using of JSON providers
- Crosscutting aspects in JAX-RS filters and interceptors
- Bean validation

The main goals of this presentation are to share the best practices, experience and discuss the most important aspects of designing and implementing REST APIs in your projects.

Security is the common requirement for almost all of the web service related products and solutions. Apache CXF framework provides a wide range of the security features for REST and SOAP services. It supports a number of security standards like OAuth, WS-Trust, WS-Federation. CXF users can benefit from new functionality in Authorization, Key Management and Security Token Service components.
This presentation will review CXF security features and illustrate them with the code. Andrei will show how the security requirements have been implemented in the real projects and discuss possible alternatives.
Which security options are available for the REST service? How to achieve federated authentication in CXF applications? How to implement authorization in web service? What is the benefit of the public key infrastructure and XKMS? - These questions will be discussed during the session.