From 34f861f74ef2402ab34487ca593d2d0eeebd281b Mon Sep 17 00:00:00 2001
From: Thomas Wiese <mail@thomaswiese.de>
Date: Thu, 25 Oct 2018 10:58:46 +0200
Subject: [PATCH] allow anonymous access to Regatta Rest-API endpoint
 createAndAddCompetitor for registering on open regattas

---
 .../resources/shiro.ini                       |  6 ++++-
 ...onymousAuthenticationFilterSAPSailing.java | 22 +++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)
 create mode 100644 java/com.sap.sailing.server/src/com/sap/sailing/server/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing.java

diff --git a/java/com.sap.sailing.server.gateway/resources/shiro.ini b/java/com.sap.sailing.server.gateway/resources/shiro.ini
index 4687581e24c..8ba95050f5e 100755
--- a/java/com.sap.sailing.server.gateway/resources/shiro.ini
+++ b/java/com.sap.sailing.server.gateway/resources/shiro.ini
@@ -55,6 +55,10 @@ authc.successUrl = /api/restsecurity/hello
 # authentication with POST parameters "username" and "password".
 bearerToken = com.sap.sailing.server.security.BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing
 
+# The same as bearerToken, but with additional fallback to anonymous authentitication.
+# In this case sufficent permission checks have to be done on the application side.
+bearerTokenOrAnonymous = com.sap.sailing.server.security.BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing
+
 # Specifying filter chains for URL patterns
 
 [urls]
@@ -73,7 +77,7 @@ bearerToken = com.sap.sailing.server.security.BearerTokenOrBasicOrFormAuthentica
 /api/v1/regattas/*/removeracecolumn = bearerToken
 /api/v1/regattas/*/competitors/*/add = bearerToken
 /api/v1/regattas/*/competitors/*/remove = bearerToken
-/api/v1/regattas/*/competitors/createandadd = bearerToken
+/api/v1/regattas/*/competitors/createandadd = bearerTokenOrAnonymous
 
 # Secure the access (in particular the POST/write access) to posting race log events
 /rc/racelog = bearerToken
diff --git a/java/com.sap.sailing.server/src/com/sap/sailing/server/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing.java b/java/com.sap.sailing.server/src/com/sap/sailing/server/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing.java
new file mode 100644
index 00000000000..3b2b006ff47
--- /dev/null
+++ b/java/com.sap.sailing.server/src/com/sap/sailing/server/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing.java
@@ -0,0 +1,22 @@
+package com.sap.sailing.server.security;
+
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+
+import com.sap.sse.ServerStartupConstants;
+import com.sap.sse.security.BearerTokenOrBasicOrFormAuthenticationFilter;
+
+public class BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing
+        extends BearerTokenOrBasicOrFormAuthenticationFilter {
+
+    public BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing() {
+        super("SAP Sailing Analytics (" + /* application name */ ServerStartupConstants.SERVER_NAME + ")");
+    }
+
+    @Override
+    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
+        super.onAccessDenied(request, response);
+        return true;
+    }
+
+}