allow anonymous access to Regatta Rest-API endpoint createAndAddCompetitor for registering on open regattas

java/com.sap.sailing.server.gateway/resources/shiro.ini

@@ -55,6 +55,10 @@ authc.successUrl = /api/restsecurity/hello
 # authentication with POST parameters "username" and "password".
 bearerToken = com.sap.sailing.server.security.BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing
 
+# The same as bearerToken, but with additional fallback to anonymous authentitication.
+# In this case sufficent permission checks have to be done on the application side.
+bearerTokenOrAnonymous = com.sap.sailing.server.security.BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing
+
 # Specifying filter chains for URL patterns
 
 [urls]
@@ -73,7 +77,7 @@ bearerToken = com.sap.sailing.server.security.BearerTokenOrBasicOrFormAuthentica
 /api/v1/regattas/*/removeracecolumn = bearerToken
 /api/v1/regattas/*/competitors/*/add = bearerToken
 /api/v1/regattas/*/competitors/*/remove = bearerToken
-/api/v1/regattas/*/competitors/createandadd = bearerToken
+/api/v1/regattas/*/competitors/createandadd = bearerTokenOrAnonymous
 
 # Secure the access (in particular the POST/write access) to posting race log events
 /rc/racelog = bearerToken

java/com.sap.sailing.server/src/com/sap/sailing/server/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing.java

@@ -0,0 +1,22 @@
+package com.sap.sailing.server.security;
+
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+
+import com.sap.sse.ServerStartupConstants;
+import com.sap.sse.security.BearerTokenOrBasicOrFormAuthenticationFilter;
+
+public class BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing
+        extends BearerTokenOrBasicOrFormAuthenticationFilter {
+
+    public BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing() {
+        super("SAP Sailing Analytics (" + /* application name */ ServerStartupConstants.SERVER_NAME + ")");
+    }
+
+    @Override
+    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
+        super.onAccessDenied(request, response);
+        return true;
+    }
+
+}