Securing REST API using APIKeys? - rest

Question

We have a Spring web application secured using Spring Security and a set of SOAP API services uses the same security domain #org.jboss.ejb3.annotation.SecurityDomain that the Spring MVC uses to authenticate users.
We are now in process to refactor our application and to create,secure REST APIs.
We thought to follow the below approach
Spring #RestController methods act as REST APIS/webservices to replace our existing soap APIs.
Spring OAuth2 to protect the REST APIs
Spring MVC continue using the spring security and the security domain defined in the wildfly server, and after the form-login once the user is authenticated from the javascript/angular js use the oauth access token to invoke the protected REST APIs
Spring Configuration
<http pattern="/restapi/**" entry-point-ref="oauthAuthenticationEntryPoint"
create-session="stateless" xmlns="http://www.springframework.org/schema/security"
use-expressions="true">
<anonymous enabled="false" />
<access-denied-handler ref="oauthAccessDeniedHandler" />
<intercept-url pattern="/restapi/**" access="isAuthenticated()" />
<remember-me key="myapp" services-ref="rememberMeServices" />
<custom-filter ref="jbossSecurityFilter" after="REMEMBER_ME_FILTER" />
<custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
</http>
<http pattern="/oauth/token" create-session="stateless"
use-expressions="true" authentication-manager-ref="authenticationManager">
<intercept-url pattern="/oauth/token" access="isAuthenticated()" />
<anonymous enabled="false" />
<custom-filter ref="clientCredentialsTokenEndpointFilter"
before="BASIC_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler" />
<http-basic entry-point-ref="clientAuthenticationEntryPoint" />
<remember-me key="myapp" services-ref="rememberMeServices" />
<custom-filter ref="jbossSecurityFilter" after="REMEMBER_ME_FILTER" />
</http>
<beans:bean id="jaasAuthenticationProvider" class="org.springframework.security.authentication.jaas.JaasAuthenticationProvider">
<beans:property name="refreshConfigurationOnStartup" value="false"/>
<beans:property name="loginConfig" value="/WEB-INF/login.conf" />
<beans:property name="loginContextName" value="AppName" />
<beans:property name="callbackHandlers">
<beans:list>
<beans:ref bean="jaasNameCallBackHandler" />
<beans:bean class="org.springframework.security.authentication.jaas.JaasPasswordCallbackHandler" />
</beans:list>
</beans:property>
<beans:property name="authorityGranters">
<beans:list>
<beans:bean class="com.custom.CustomAuthorityGranter" />
</beans:list>
</beans:property>
</beans:bean>
The third party applications or the REST API clients will use the below steps to get access tokens and to access protected REST APIs
http://hostname:8080/myapp/oauth/token?grant_type=password&client_id=X&username=user1&password=secret&client_secret=XYZ&scope=read+write+trust
http://hostname:8080/myapp/restapi/getdata?access_token=5ec70b18-d9eb-449b-a1fa-d29c3d47274d
Is it safe to ask our webservice clients to send their credentials in the request param/headers to get the access tokens ?
Is that good approach to save the tokens in the server sessions to use it in the UI for the Spring MVC requests ?
We are also asked to consider the API Keys to access the REST APIs. By using API Keys can we get the ejb session context and user details? If so can we use the API Keys along with the spring security in the Web part ?