we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend REST Service (auth/auth)
This server is going to be used in a business environment which means we have an LDAP/Active Directory at our disposable. The informations which I are going to be served out via this API are high-valuable and should be adequatly protected on the device and on the server. The app and backend is going to be used by employees, there are no public users.
We are going to use an Application Server (Glassfish) as the base componente for our backend. I want to use the built-in security mechanisms as I want to avoid to invent my own solutions which are probably going to be inferior.
What is a best-practice to secure the backend from unauthorized/unauthenticated access?
Or more specifically:
- How could I secure the access to the backend?
- Is it an option to transmit the username and password with every request made from mobile device to backend?
- Is it good practice to validate the transmitted Username/Password against the LDAP?
Nice to know:
- The gateway-server is behind a reverse-proxy.
- User need to authenticate themselves with Username/Password when they want to replicate( connect to the backend)
- communication between device and backend is going to be protected with TLS