• There are two web-applications deployed on a glassfish server.
• Both web applications provide a REST web service.
• the access to both web-services is secured via glassfish security constraints (at the moment BASIC Auth and file-realm).

Let's say a user is accessing the service of web application A. After he is authorized, service A wants to call service B via REST client.

Is there a way for a service to impersonate a user that is already authorized to the glasfish server? Maybe something like forwarding the security context or editing the headers? Is there another Filter?

@Context
private SecurityContext securityContext;

username = securityContext.getUserPrincipal().getName();
password = ???    

client.addFilter(new com.sun.jersey.api.client.filter.HTTPBasicAuthFilter(username, password));

Thanks!