Merge branch 'bug5085' into bug5165

java/com.sap.sailing.shared.server/src/com/sap/sailing/shared/server/security/BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing.java

@@ -6,7 +6,9 @@ import com.sap.sse.security.BearerTokenOrBasicOrFormAuthenticationFilter;
 public class BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing extends
         BearerTokenOrBasicOrFormAuthenticationFilter {
 
+    protected static final String SAP_SAILING_ANALYTICS_APPLICATION_NAME = "SAP Sailing Analytics (" + /* application name */ ServerInfo.getName() + ")";
+
     public BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing() {
-        super("SAP Sailing Analytics (" + /* application name */ ServerInfo.getName() + ")");
+        super(SAP_SAILING_ANALYTICS_APPLICATION_NAME);
     }
 }

java/com.sap.sailing.shared.server/src/com/sap/sailing/shared/server/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing.java

@@ -1,20 +1,10 @@
 package com.sap.sailing.shared.server.security;
 
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
+import com.sap.sse.security.BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter;
 
 public class BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing
-        extends BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing {
-
-    @Override
-    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
-        super.onAccessDenied(request, response);
-        return true; // The request should always be processed, in case of doubt anonymously.
+        extends BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter {
+    public BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing() {
+        super(BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing.SAP_SAILING_ANALYTICS_APPLICATION_NAME);
     }
-    
-    @Override
-    protected boolean sendChallenge(ServletRequest request, ServletResponse response) {
-        return false; // Do not build a challenge for authorization in case of an anonymous user.
-    }
-
 }

java/com.sap.sse.security/resources/shiro.ini

@@ -60,7 +60,7 @@ authc.successUrl = /api/restsecurity/hello
 # authentication ("Authentication: Basic ...") and then regular form-based
 # authentication with POST parameters "username" and "password".
 bearerToken = com.sap.sse.security.BearerTokenOrBasicOrFormAuthenticationFilter
-bearerTokenOrAnonymous = com.sap.sailing.shared.server.security.BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing
+bearerTokenOrAnonymous = com.sap.sse.security.BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter
 
 # Specifying filter chains for URL patterns
 

java/com.sap.sse.security/src/com/sap/sse/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter.java

@@ -0,0 +1,43 @@
+package com.sap.sse.security;
+
+
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+
+import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
+
+import com.sap.sse.security.jaxrs.api.SecurityResource;
+
+/**
+ * Looks for an "Authorization: Bearer <token>" HTTP header. If found, tries to authenticate a user
+ * with the bearer token presented. If instead an "Authorization: Basic ..." header field is found, HTTP
+ * basic authentication is attempted using a regular username/password token. If that isn't found, looks
+ * for username/password fields in the POST parameters, like the {@link FormAuthenticationFilter} does.<p>
+ * 
+ * This filter can be used for securing REST requests, in conjunction with the {@link SecurityResource}'s
+ * {@link SecurityResource#accessToken(String, String)} through which a bearer token can be obtained using
+ * basic authentication.
+ * 
+ * @author Axel Uhl (D043530)
+ *
+ */
+public class BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter extends BearerTokenOrBasicOrFormAuthenticationFilter {
+    public BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter() {
+        super(/* application name */ "SAP");
+    }
+    
+    protected BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter(String applicationName) {
+        super(applicationName);
+    }
+
+    @Override
+    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
+        super.onAccessDenied(request, response);
+        return true; // The request should always be processed, in case of doubt anonymously.
+    }
+    
+    @Override
+    protected boolean sendChallenge(ServletRequest request, ServletResponse response) {
+        return false; // Do not build a challenge for authorization in case of an anonymous user.
+    }
+}

java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/OwnershipResource.java

@@ -51,8 +51,8 @@ public class OwnershipResource extends AbstractSecurityResource {
     public Response setOwnership(@PathParam("objectType") String objectType,
             @PathParam("typeRelativeObjectId") String typeRelativeObjectId, String jsonBody) throws OwnershipException {
         final JSONObject json = (JSONObject) JSONValue.parse(jsonBody);
-        QualifiedObjectIdentifier identifier = new QualifiedObjectIdentifierImpl((String) json.get(KEY_OBJECT_TYPE),
-                new TypeRelativeObjectIdentifier((String) json.get(KEY_OBJECT_ID)));
+        QualifiedObjectIdentifier identifier = new QualifiedObjectIdentifierImpl(objectType,
+                new TypeRelativeObjectIdentifier(typeRelativeObjectId));
         try {
             SecurityUtils.getSubject().checkPermission(identifier.getStringPermission(DefaultActions.CHANGE_OWNERSHIP));
         } catch (Exception ex) {