I'm using Enslib.RestService. 
If i'm not mistaken, with this approach, i would still have an unauthenticated WS published. I would have to limit the calls to the business service blocking all requests not coming from the IRIS server. 
I'll take a look at this workaround. 
Thanks