We are trying to implement authentication for a web service provided by us. We created an ACL on IS level, added a goup in it and some users. The question is what settings do we need so that when someone calls our web service to authenticate the user based on the ACL which we have created. (if the user is in the group from the ACL then the call should be succesfull, otherwise the user should get something like 'You are not authorized to call this web service')
I am working on a REST service, which need basic authentication user/password. After changed ACL permissions on package, directory, or service level in the Execute ACL, the service still can be reached and get correct response without being asked for user/password or any error. We need to resolve this asap.