Does GlassFish support REST or SOAP Web Services? Both! REST through Jersey and SOAP through Metro (Jersey will be included in a future Metro release, see Roadmap). Security is very important for SOAP Web Services and Jiandong has a set of notes describing how Metro supports WS-SX (OASIS Web Services Security Exchange). Check out the Overview, How to Issue SAML Tokens and a description of a Scenario based on WS-SX.

While standarda such as SAML and XACML provide flexible, interoperable frameworks for exchanging authentication and authorization data, developers are sometimes left wanting something simpler - "Just give me an easy way to authenticate a user and check if they are authorized to access a resource".

We've been working on this in OpenSSO these past few months, building a simple set of identity services; web services for authentication, authorization, attribute retrieval and logging. With SOAP and REST endpoints, just about any application can manipulate identities in a very simple, robust way. Check out Aravindan and Marina's recent article on authentication with identity services. Subscribe to the Sun Developer Network identity feed to catch further article in this series.

The New Web Services stack in GlassFish is designed to support multiple transport, as suggested by the JAX-WS 2.0 specification, and Paul writes about using JMS as transport as an Example of Pluggable Transport written by Alexey (no entries in that blog yet). The project is JMS-WS-Transport, part of the GlassFish community.

I know of at least a couple of groups interested in improving on this prototype; if you want to join them, talk with Paul, Alexey, or participate directly in the DEV mailing list for JAX-WS.