Details about WS-Security and implementations

Question

ive read somewhere that the WS-Security specification (in JAX-WS) is concerned with three main area of focus:

1. Security token validation (authentication)
2. Message integrity (signing)
3. Message confidentiality (encryption and decryption)

QUESTION:1

Number 1 can be implemented using WSS4j. I'm looking for ways how to implement #2 and #3 or does WSS4J handle that too? if yes how?

QUESTION:2 Can this be done in REST? or anything similar to this.

Thanks,

Answer 1

Yes, WSS4J takes care of all of these things, in conjunction with a SOAP Stack such as Apache CXF. There is lots of content online about using WS-Security with CXF.

Yes it can all be done for REST too. Message integrity and confidentiality can be done using the JWS/JWE specs (implemented by CXF as well btw), authentication can be done via OpenID Connect, SAML SSO, Kerberos, HTTP/BA, etc etc.