title: How to use spring remoting with hessian and spring security?
body: <p>We have a three tier architecture and we are using spring remoting in combination with hessian. Currently we have a client app and the business app is running on two different tomcats.</p>
  
  <blockquote>
  <pre><code> Tomcat 1           Tomcat 2
  ----------        ------------
  | client |   -&gt;   | business |
  ----------        ------------
                     exposing services for clients
  </code></pre>
  </blockquote>
  
  <p>But we came across a security problem. Our exposed services (business app) requires a logged in user with special rights, for example ROLE_SUPERVISOR. The client application has a login form and the credential validation is done by the business app (the client app has no database connection). This means that the user is only logged in on the client application, the business app knows nothing about it (and this is maybe the main problem). </p>
  
  <p>We thought it is possible with spring security remoting to send all needed information from the client to the business app (i.e. the authentication object). But unfortunately this can not be done. So, we have to find another solution. </p>
  
  <ul>
  <li><p>One solution could be to send the authentication object along with every request. But this may have another security issue. The authentication object which is sent by the client, can be faked by an attacker. In this case we have to check the users' credential for every request and load his roles (granted authorities) to be sure, that he is authorized.</p></li>
  <li><p>The second solution is that both apps are aware of the logged in users, which means, when a user logged in with the client app, he is also logged in in the business app.  But, nevertheless, the user (or authorization) object must be sent with every request.</p></li>
  </ul>
  
  <p>Maybe we are missing something. Isn't there a better / easier way to do this with spring security and spring remoting. A three tier architecture isn't unusual and there must be a way to secure the exposed services.</p>
  
  <p><strong>Update</strong>
  spring remoting with hessian: client side configuration (java config)</p>
  
  <pre><code>@Bean
  public HessianProxyFactoryBean xyService() {
      HessianProxyFactoryBean xyService = new HessianProxyFactoryBean();
      xyService.setServiceUrl(remotingUrl + remotingContextPath + "/XyService");
      xyService.setServiceInterface(XyService.class);
  
      return xyService;
  }
  </code></pre>
  
  <p>business side:</p>
  
  <pre><code>@Bean(name = "/XyService")
  public HessianServiceExporter xyService() {
      HessianServiceExporter hessianServiceExporter = new HessianServiceExporter();
      hessianServiceExporter.setServiceInterface(XyService.class);
      hessianServiceExporter.setService(xyServiceImpl);
      return hessianServiceExporter;
  }
  </code></pre>
  
  <p>I appreciate your help!
  Thanks, Daniel</p>