RESTful authentication for Java EE
In my experience, it is hard to implement a system using Java EE authentication and authorisation service that would work for both REST services and Server side MVC like JSP or JSF at the same time. All my experience are leaning towards using Form based authentication for the MVC part and some sort of token authentication (OAuth, Kerberos, LTPA) for REST services. Using Form or Basic authentication for REST services was usually challenging to implement, although we did it and it works fine on two projects.
It also depends on the preferred server implementation.
Probably debatable whether these are RESTful, but would be good to at least address the following:
What about Keberos?Using an authentication server such as Windows AD...
What about public-key certificates? Relying on client-provided certificates to identify a user...
What about Tokens? Third-party token issuers such as OpenID...