javajax-rs2.0+；泽西岛+；码头保安

我正在构建一个RESTful Web服务，其中我有一组只应由管理员使用的命令。理想情况下，我会设置两个端口，都使用服务器端SSL，但是一个端口需要客户端SSL。我想知道如何按港口划分资源。或者，我可以将系统设置为对每个资源使用@RolesAllowed，在这种情况下，我需要知道如何设置用户的角色（按端口设置会更好）。到目前为止，我有一个http和https端口设置和工作。我也有所有的资源设置

下面显示的两个文件是使用webservice运行的唯一文件，了解这一点也很好。没有容器文件等。 请记住，并非所有代码都是完整的。代码如下：

import org.eclipse.jetty.http.HttpVersion;
import org.eclipse.jetty.server.*;
import org.eclipse.jetty.servlet.ServletContextHandler;
import org.eclipse.jetty.servlet.ServletHolder;
import org.eclipse.jetty.util.ssl.SslContextFactory;

import java.io.File;
import java.io.FileNotFoundException;


public class Core {

static String jettyKeystore = "Assets/keys/keystore";
//http://www.eclipse.org/jetty/documentation/current/configuring-ssl.html

public static void main(String args[]) throws FileNotFoundException {
    String keystorePath = System.getProperty(
            "example.keystore", jettyKeystore);
    File keyStoreFile = new File(keystorePath);
    if (!keyStoreFile.exists()) {
        throw new FileNotFoundException(keyStoreFile.getAbsolutePath());
    }

    ServletContextHandler context = new ServletContextHandler(ServletContextHandler.SESSIONS);
    context.setContextPath("/");

    int port = 8080;
    int securePort = 8084;

    HttpConfiguration httpConf = new HttpConfiguration();
    httpConf.setSecureScheme("https");
    httpConf.setSecurePort(securePort);
    httpConf.setOutputBufferSize(32768);

    Server jettyServer = new Server();
    ServerConnector http = new ServerConnector(jettyServer,
            new HttpConnectionFactory(httpConf));
    http.setPort(port);
    http.setIdleTimeout(30000);

    SslContextFactory sslContextFactory = new SslContextFactory();
    sslContextFactory.setKeyStorePath(keyStoreFile.getAbsolutePath());
    sslContextFactory.setKeyStorePassword("password");
    sslContextFactory.setKeyManagerPassword("password");
    //sslContextFactory.setNeedClientAuth(true);

    HttpConfiguration httpsConf = new HttpConfiguration(httpConf);
    httpsConf.addCustomizer(new SecureRequestCustomizer());


    ServerConnector https = new ServerConnector(jettyServer,
            new SslConnectionFactory(sslContextFactory, HttpVersion.HTTP_1_1.asString()),
            new HttpConnectionFactory(httpsConf));
    https.setPort(securePort);
    https.setIdleTimeout(500000);

    jettyServer.setConnectors(new Connector[]{http, https});


    jettyServer.setHandler(context);
    ServletHolder jerseyServlet = context.addServlet(
            org.glassfish.jersey.servlet.ServletContainer.class,     "/*");

    jerseyServlet.setInitOrder(0);


    jerseyServlet.setInitParameter(
            "jersey.config.server.provider.classnames",
            RQHandler.class.getCanonicalName());


    try {
        jettyServer.start();
        System.err.println("Server Started on port: " + port + "," +          securePort);
        jettyServer.join();
    } catch (InterruptedException e) {
        e.printStackTrace();
    } catch (Exception e) {
        e.printStackTrace();
    } finally {
        jettyServer.destroy();
    }

}
}

以下是资源文件：

import com.mongodb.DB;
import com.mongodb.DBCollection;
import com.mongodb.DBCursor;
import com.mongodb.MongoClient;
import com.sun.xml.internal.messaging.saaj.packaging.mime.internet.ContentDisposition;

import java.io.*;
import java.net.UnknownHostException;

import javax.annotation.security.PermitAll;
import javax.annotation.security.RolesAllowed;
import javax.websocket.server.PathParam;
import javax.ws.rs.*;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.StreamingOutput;

@Path("audio_archives")
public class RQHandler {
MongoClient mc;
DB db;
DBCollection audioCollection;
DBCollection videoCollection;

{
    try {
        mc = new MongoClient("localhost");
        db = mc.getDB("ziondb");
        audioCollection = db.getCollection("audio");
        videoCollection = db.getCollection("video");
    } catch (UnknownHostException e) {
        e.printStackTrace();
        System.out.println("exiting!");
        System.exit(0);
    }
}




@GET
@Path("getMedia")
@Produces(MediaType.TEXT_PLAIN)
public String getAllMedia(@QueryParam("type") String type){
    String DBreturn = "";

    if(type.toLowerCase().equals("audio")) {
        DBCursor cursor = audioCollection.find();

        try {
            while (cursor.hasNext()) {
                DBreturn += cursor.next();
            }
        } finally {
            cursor.close();
        }

    } else if(type.toLowerCase().equals("video")) {
        DBCursor cursor = videoCollection.find();

        try {
            while (cursor.hasNext()) {
                DBreturn += cursor.next();
            }
        } finally {
            cursor.close();
        }
    }

    if (DBreturn.equals("")) {
        DBreturn = "{ \"entries\" : \"null\" }";
    }
    return DBreturn;
}


@GET
@Path("getMediaFile")
@Produces({"video/mp4"}) //use application/type for downloadable file
public File getMediaFile(@QueryParam("type") String type,@QueryParam("resourceId") String id){
    String DBreturn = "";

    if(type.toLowerCase().equals("audio")) {
        DBCursor cursor = audioCollection.find();

        try {
            while (cursor.hasNext()) {
                DBreturn += cursor.next();
            }
        } finally {
            cursor.close();
        }

    } else if(type.toLowerCase().equals("video")) {
        DBCursor cursor = videoCollection.find();

        try {
            while (cursor.hasNext()) {
                DBreturn += cursor.next();
            }
        } finally {
            cursor.close();
        }
    }

    if (DBreturn.equals("")) {
        DBreturn = "{ \"entries\" : \"null\" }";
    }
    return (new File("/home/digitalblueeye/Downloads/SampleVideo_1280x720_50mb.mp4"));
}

@GET
@Path("getMediaStream")
@Produces({"video/mp4"}) //use application/type for downloadable file
public StreamingOutput getMediaStream(@QueryParam("type") String type, @QueryParam("resourceId") String id){
    return new StreamingOutput() {
        @Override
        public void write(OutputStream outputStream) throws IOException, WebApplicationException {
            File file = new File("/home/digitalblueeye/Downloads/SampleVideo_1280x720_50mb.mp4");
            outputStream = new FileOutputStream(file);
            outputStream.write(0);
        }
    };
}


//********************************************************

@GET
@Path("")
@Produces(MediaType.TEXT_HTML)
public static File home() {

    return (new File("Assets/index.html"));
}

@GET
@Path("developers")
@Produces(MediaType.TEXT_HTML)
public static File sysInfo() {

    return (new File("Assets/manual.html"));
}

@GET
@Produces(MediaType.APPLICATION_JSON)
@Path("list_by_date")
public String listByDate(@QueryParam("model") String model,
                         @QueryParam("from") String fromDate,
                         @QueryParam("to") String toDate,
                         @QueryParam("quota") String quota) {

    return null;
}

@GET
@Produces(MediaType.APPLICATION_JSON)
@Path("list_by_param")
public String listByParam(@QueryParam("model") String model,
                          @QueryParam("param_type") String paramType,
                          @QueryParam("param") String param,
                          @QueryParam("quota") String quota) {
    return null;
}

@GET
@Produces(MediaType.APPLICATION_JSON)
@Path("list_files")
public String listFile(@QueryParam("id") String id) {
    return null;
}

@GET
@Produces("application/mp3,application/wav")
@Path("get_file")
public File getFile(@QueryParam("id") String id) {
    return null;
}

@GET
@Produces("audio/mp3,audio/wav")
@Path("stream_file")
public File streamFile(@QueryParam("id") String id) {
    return null;
}

private byte[] readFromStream(InputStream stream) throws IOException {
    ByteArrayOutputStream baos = new ByteArrayOutputStream();

    byte[] buffer = new byte[1000];
    int wasRead = 0;
    do {
        wasRead = stream.read(buffer);
        if (wasRead > 0) {
            baos.write(buffer, 0, wasRead);
        }
    } while (wasRead > -1);
    return baos.toByteArray();

}

@PUT
@Consumes(MediaType.APPLICATION_JSON)
@Path("get_auth_secret")
public void get_auth_secret(InputStream is) throws IOException {
    byte[] bytes = readFromStream(is);
    String input = new String(bytes);
    System.out.println(input);
}

@POST
@Consumes(MediaType.APPLICATION_JSON)
@Path("update")//update reources
public void putstuff(InputStream is) throws IOException {
    byte[] bytes = readFromStream(is);
    String input = new String(bytes);
    System.out.println(input);
}

@DELETE
@Consumes(MediaType.APPLICATION_JSON)//use json for batch delete
@Path("delete")//delete reources
public void deletestuff(InputStream is) throws IOException {
    byte[] bytes = readFromStream(is);
    String input = new String(bytes);
    System.out.println(input);
}

@PUT
@Consumes("application/mp3,application/wav")
@Path("create")//create resources
public void createstuff(InputStream is) throws IOException {
    byte[] bytes = readFromStream(is);
    String input = new String(bytes);
    System.out.println(input);
}

/*

@POST
@Path("/upload")
@Consumes(MediaType.MULTIPART_FORM_DATA)
public Response uploadFile(
        @FormParam("file") InputStream fileInputStream,
        @QueryParam("filename") String filename) {

    String filePath = "FileStore/audio/" + filename;

    // save the file to the server
    saveFile(fileInputStream, filePath);

    String output = "File saved to server location : " + filePath;

    return Response.status(200).entity(output).build();

}

// save uploaded file to a defined location on the server
private void saveFile(InputStream uploadedInputStream,
                      String serverLocation) {

    try {
        OutputStream outpuStream = new FileOutputStream(new File(serverLocation));
        int read = 0;
        byte[] bytes = new byte[1024];

        outpuStream = new FileOutputStream(new File(serverLocation));
        while ((read = uploadedInputStream.read(bytes)) != -1) {
            outpuStream.write(bytes, 0, read);
        }
        outpuStream.flush();
        outpuStream.close();
    } catch (IOException e) {

        e.printStackTrace();
    }

}

@POST
@Path("/upload")
@Consumes(MediaType.MULTIPART_FORM_DATA)
public Response uploadFile(
        @FormDataParam("file") InputStream inputStream,
        @FormDataParam("file") FormDataContentDisposition formDataContentDisposition) {
    String fileName = formDataContentDisposition.getFileName();

    String filePath = saveFile(inputStream, fileName);

    String output = "File: " + filePath;

    return Response.status(Response.Status.CREATED).entity(output).build();
}

@POST
@Path("/multi")
@Consumes(MediaType.MULTIPART_FORM_DATA)
public Response uploadFile(
        FormDataMultiPart form) {
    FormDataBodyPart filePart = form.getField("file");

    ContentDisposition headerOfFilePart = filePart.getContentDisposition();

    InputStream inputStream = filePart.getValueAs(InputStream.class);

    String filePath = saveFile(inputStream, headerOfFilePart.getFileName());

    String output = "File: " + filePath;

    return Response.status(Response.Status.CREATED).entity(output).build();
}

private String saveFile(InputStream inputStream, String fileName) {
    try {
        File file = File.createTempFile("temp", ".txt");
        OutputStream outputStream = new FileOutputStream(file);
        int read = 0;
        byte[] bytes = new byte[1024];

        while ((read = inputStream.read(bytes)) != -1) {
            outputStream.write(bytes, 0, read);
        }
        outputStream.flush();
        outputStream.close();
        return file.getAbsolutePath();
    } catch (Exception e) {

    }
    return "";
}
*/


//Media streaming with JAX-RS https://github.com/aruld/jersey-streaming
}

---

我希望保护的方法有PUT、POST和DELETE。我只是想确保只有管理员可以创建、更新和删除资源。因为桌面程序将是使用管理方法的唯一方式，所以我并不担心在网站中实现管理方法的难易性

为什么不使用某种形式的外部化授权？春季安全？XACML？我是个新来一起休息的人。从什么地方开始比较好？我还考虑过在头上使用基本身份验证，因为我已经在使用HTTPS了