From f8666a806d2b49dfd639fa505a844fe2478671ac Mon Sep 17 00:00:00 2001 From: Axel Uhl Date: Mon, 31 Jul 2017 18:24:49 +0200 Subject: [PATCH 1/4] bug 4254: provide user creation, deletion, edit and password recovery REST support Change-Id: I6e71971b21d01de642afae2632a2eb415b24d85f --- java/com.sap.sse.security/resources/shiro.ini | 3 +- .../security/impl/SecurityServiceImpl.java | 2 +- .../security/jaxrs/api/SecurityResource.java | 175 ++++++++++++++++++ .../webservices/api/access_token.html | 2 +- .../api/{login.html => change_password.html} | 14 +- .../webservices/api/create_user.html | 120 ++++++++++++ .../webservices/api/forgot_password.html | 118 ++++++++++++ .../webservices/api/index.html | 24 ++- .../webservices/api/user.html | 91 +++++++++ 9 files changed, 532 insertions(+), 17 deletions(-) rename java/com.sap.sse.security/webservices/api/{login.html => change_password.html} (56%) create mode 100755 java/com.sap.sse.security/webservices/api/create_user.html create mode 100755 java/com.sap.sse.security/webservices/api/forgot_password.html create mode 100755 java/com.sap.sse.security/webservices/api/user.html diff --git a/java/com.sap.sse.security/resources/shiro.ini b/java/com.sap.sse.security/resources/shiro.ini index 135cf304a64..85c926e3e34 100644 --- a/java/com.sap.sse.security/resources/shiro.ini +++ b/java/com.sap.sse.security/resources/shiro.ini @@ -66,7 +66,8 @@ bearerToken = com.sap.sse.security.BearerTokenOrBasicOrFormAuthenticationFilter # Specifying filter chains for URL patterns [urls] -/api/restsecurity/login = authc +/api/restsecurity/user = bearerToken +/api/restsecurity/change_password = bearerToken /api/restsecurity/logout = logout /api/restsecurity/access_token = bearerToken /api/restsecurity/remove_access_token = bearerToken diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java index 8e5d409734d..efc3b90f66b 100644 --- a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java @@ -889,7 +889,7 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat private void ensureThatUserInQuestionIsLoggedInOrCurrentUserIsAdmin(String username) { final Subject subject = SecurityUtils.getSubject(); - if (!subject.hasRole(DefaultRoles.ADMIN.name()) && (subject.getPrincipal() == null + if (!subject.hasRole(DefaultRoles.ADMIN.getRolename()) && (subject.getPrincipal() == null || !username.equals(subject.getPrincipal().toString()))) { final String currentUserName = subject.getPrincipal() == null ? "" : subject.getPrincipal().toString(); diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java b/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java index 6bad1b2363a..f0b987a09d3 100644 --- a/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java @@ -1,21 +1,35 @@ package com.sap.sse.security.jaxrs.api; +import javax.ws.rs.DELETE; +import javax.ws.rs.FormParam; import javax.ws.rs.GET; import javax.ws.rs.POST; +import javax.ws.rs.PUT; import javax.ws.rs.Path; import javax.ws.rs.Produces; +import javax.ws.rs.QueryParam; +import javax.ws.rs.core.Context; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; +import javax.ws.rs.core.UriInfo; import org.apache.shiro.SecurityUtils; +import org.apache.shiro.authc.UsernamePasswordToken; import org.apache.shiro.subject.Subject; import org.json.simple.JSONObject; +import com.sap.sse.common.Util; +import com.sap.sse.common.mail.MailException; +import com.sap.sse.security.User; import com.sap.sse.security.jaxrs.AbstractSecurityResource; +import com.sap.sse.security.shared.DefaultRoles; +import com.sap.sse.security.shared.UserManagementException; import com.sun.jersey.api.client.ClientResponse.Status; @Path("/restsecurity") public class SecurityResource extends AbstractSecurityResource { + private static final String SECURITY_UI_URL_PATH = "/security/ui/"; + /** * Can be used to figure out the current subject. Accepts the GET method. If the subject is * authenticated, the service will respond with a "Hello <subjectname>" message, otherwise @@ -48,7 +62,153 @@ public class SecurityResource extends AbstractSecurityResource { public Response sayHelloPost() { return doSayHello(); } + + @POST + @Path("/change_password") + @Produces("text/plain;charset=UTF-8") + public Response changePassword(@FormParam("username") String username, @FormParam("password") String password) { + final Subject subject = SecurityUtils.getSubject(); + if (!subject.hasRole(DefaultRoles.ADMIN.getRolename()) && (subject.getPrincipal() == null + || !username.equals(subject.getPrincipal().toString()))) { + return Response.status(Status.UNAUTHORIZED).build(); + } else { + try { + getService().updateSimpleUserPassword(username, password); + return Response.ok().build(); + } catch (UserManagementException e) { + return Response.status(Status.PRECONDITION_FAILED).entity(e.getMessage()).build(); + } + } + } + @POST + @Path("/forgot_password") + @Produces("text/plain;charset=UTF-8") + public Response forgotPassword(@Context UriInfo uriInfo, @QueryParam("username") String username, @QueryParam("email") String email) { + try { + final User user; + if (username != null) { + user = getService().getUserByName(username); + } else if (email != null) { + user = getService().getUserByEmail(email); + } else { + return Response.status(Status.PRECONDITION_FAILED).entity("username or email must be provided").build(); + } + if (user == null) { + return Response.status(Status.PRECONDITION_FAILED).entity("user not found").build(); + } else { + getService().resetPassword(user.getName(), getPasswordResetURL(uriInfo)); + return Response.ok().build(); + } + } catch (UserManagementException | MailException e) { + return Response.status(Status.PRECONDITION_FAILED).entity(e.getMessage()).build(); + } + } + + @POST + @Path("/create_user") + @Produces("text/plain;charset=UTF-8") + public Response createUser(@Context UriInfo uriInfo, @QueryParam("username") String username, @QueryParam("email") String email, + @QueryParam("password") String password, @QueryParam("fullName") String fullName, + @QueryParam("company") String company) { + try { + final String validationBaseURL = getEmailValidationBaseURL(uriInfo); + getService().createSimpleUser(username, email, password, fullName, company, validationBaseURL); + SecurityUtils.getSubject().login(new UsernamePasswordToken(username, password)); + return respondWithAccessTokenForUser(username); + } catch (UserManagementException | MailException e) { + return Response.status(Status.PRECONDITION_FAILED).entity(e.getMessage()).build(); + } + } + + private String getEmailValidationBaseURL(UriInfo uriInfo) { + final String urlPath = SECURITY_UI_URL_PATH+"EmailValidation.html"; + return getContextUrl(uriInfo, urlPath); + } + + private String getPasswordResetURL(UriInfo uriInfo) { + final String urlPath = SECURITY_UI_URL_PATH+"EditProfile.html"; + return getContextUrl(uriInfo, urlPath); + } + + private String getContextUrl(UriInfo uriInfo, final String urlPath) { + final String validationBaseURL = uriInfo.getBaseUri().getScheme()+"://"+uriInfo.getBaseUri().getHost()+ + (uriInfo.getBaseUri().getPort() == -1 ? "" : (":"+uriInfo.getBaseUri().getPort()))+urlPath; + return validationBaseURL; + } + + @GET + @Path("/user") + @Produces("application/json;charset=UTF-8") + public Response getUser(@QueryParam("username") String username) { + final Subject subject = SecurityUtils.getSubject(); + // ADMIN can query all; otherwise, only the owning user can query + // TODO: ideally, we would introduce a USER:READ: permission which later can be granted to tenant admins for all users of that tenant + if (subject.getPrincipal() == null || (username != null && !subject.hasRole(DefaultRoles.ADMIN.getRolename()))) { + return Response.status(Status.UNAUTHORIZED).build(); + } else { + final User user = getService().getUserByName(username == null ? subject.getPrincipal().toString() : username); + if (user == null) { + return Response.status(Status.PRECONDITION_FAILED).entity("User "+username+" not known").build(); + } else { + JSONObject result = new JSONObject(); + result.put("username", username); + result.put("fullName", user.getFullName()); + result.put("email", user.getEmail()); + result.put("company", user.getCompany()); + return Response.ok(result.toJSONString()).build(); + } + } + } + + @DELETE + @Path("/user") + @Produces("text/plain;charset=UTF-8") + public Response deleteUser(@QueryParam("username") String username) { + final Subject subject = SecurityUtils.getSubject(); + // the signed-in subject has role ADMIN + if (!subject.hasRole(DefaultRoles.ADMIN.getRolename()) && (subject.getPrincipal() == null + || !username.equals(subject.getPrincipal().toString()))) { + return Response.status(Status.UNAUTHORIZED).build(); + } else { + try { + getService().deleteUser(username); + return Response.ok().build(); + } catch (UserManagementException e) { + return Response.status(Status.PRECONDITION_FAILED).entity(e.getMessage()).build(); + } + } + } + + @PUT + @Path("/user") + @Produces("text/plain;charset=UTF-8") + public Response updateUser(@Context UriInfo uriInfo, @QueryParam("username") String username, + @QueryParam("email") String email, @QueryParam("fullName") String fullName, + @QueryParam("company") String company) { + final Subject subject = SecurityUtils.getSubject(); + // the signed-in subject has role ADMIN + if (!subject.hasRole(DefaultRoles.ADMIN.getRolename()) && (subject.getPrincipal() == null + || !username.equals(subject.getPrincipal().toString()))) { + return Response.status(Status.UNAUTHORIZED).build(); + } else { + try { + final User user = getService().getUserByName(username); + if (user == null) { + return Response.status(Status.PRECONDITION_FAILED).entity("User "+username+" not known").build(); + } else { + getService().updateUserProperties(username, fullName, company, user.getLocale()); + if (!Util.equalsWithNull(user.getEmail(), email)) { + getService().updateSimpleUserEmail(username, email, getEmailValidationBaseURL(uriInfo)); + } + return Response.ok().build(); + } + } catch (UserManagementException e) { + return Response.status(Status.PRECONDITION_FAILED).entity(e.getMessage()).build(); + } + } + } + @GET @Path("/access_token") @Produces("application/json;charset=UTF-8") @@ -62,6 +222,21 @@ public class SecurityResource extends AbstractSecurityResource { public Response accessTokenPost() { return respondWithAccessTokenForAuthenticatedSubject(); } + + @GET + @Path("/logout") + @Produces("application/json;charset=UTF-8") + public Response logout() { + return logoutPost(); + } + + @POST + @Path("/logout") + @Produces("application/json;charset=UTF-8") + public Response logoutPost() { + getService().logout(); + return Response.ok().build(); + } @GET @Path("/remove_access_token") diff --git a/java/com.sap.sse.security/webservices/api/access_token.html b/java/com.sap.sse.security/webservices/api/access_token.html index e8eadadfd30..1254ab96734 100755 --- a/java/com.sap.sse.security/webservices/api/access_token.html +++ b/java/com.sap.sse.security/webservices/api/access_token.html @@ -45,7 +45,7 @@ shorthand URL notations with ":" and "@" to denote basic authentication, with th curl -D /tmp/header -b JSESSIONID=5e94c93e-b515-4bcd-8df8-0c786805a9e0 http://127.0.0.1:8888/security/api/restsecurity/access_token
Using POST username and password form parameters:
- curl -d "username=admin&password=admin"-D /tmp/header http://127.0.0.1:8888/security/api/restsecurity/access_token + curl -d "username=admin&password=admin" -D /tmp/header http://127.0.0.1:8888/security/api/restsecurity/access_token
Using a bearer access token:
curl -D /tmp/header -H "Authorization: Bearer MVPg/uCV1QGqMDmDtUuOQBrSrB1NlIldm0LW+dnxZ2A=" http://127.0.0.1:8888/security/api/restsecurity/access_token diff --git a/java/com.sap.sse.security/webservices/api/login.html b/java/com.sap.sse.security/webservices/api/change_password.html similarity index 56% rename from java/com.sap.sse.security/webservices/api/login.html rename to java/com.sap.sse.security/webservices/api/change_password.html index aceb9509686..2fc79ba1ebf 100755 --- a/java/com.sap.sse.security/webservices/api/login.html +++ b/java/com.sap.sse.security/webservices/api/change_password.html @@ -9,12 +9,11 @@

SAP Sponsorships Engine Security Webservices API

-

URL: /api/restsecurity/login

+

URL: /api/restsecurity/change_password

Description: -

The service authenticates a subject based on POST form parameter and creates a session. - The session is represented by the JSESSIONID cookie value which can be used in subsequent - requests to the same session with the same authenticated subject.

+

The service updates a user's password. This requires that user to be the currently authenticated +subject or to have administrator permissions.


@@ -23,8 +22,7 @@ - @@ -36,8 +34,8 @@ - +
Output format:Redirect (302 Found) to /api/restsecurity/hello which delivers a JSON document of the following format
- 
{"principal":"admin","authenticated":true,"remembered":false}
+ 		An Empty response with status code 200 in case of success; error-indicating status codes otherwise
Example:curl -L -D /tmp/header -d "username=admin&password=admin" http://127.0.0.1:8888/security/api/restsecurity/login
- Will provide a redirect and a JSON document as explained above.		curl -X POST -d "username=uhl&password=123" "http://127.0.0.1:8888/security/api/restsecurity/user"
+ Will provide a JSON document as explained above.
diff --git a/java/com.sap.sse.security/webservices/api/create_user.html b/java/com.sap.sse.security/webservices/api/create_user.html new file mode 100755 index 00000000000..d7686c86dcb --- /dev/null +++ b/java/com.sap.sse.security/webservices/api/create_user.html @@ -0,0 +1,120 @@ + + + + + + + + SAP Sponsorships Engine Security Webservices API + + +

SAP Sponsorships Engine Security Webservices API

+

URL: /api/restsecurity/create_user

+ +Description: +

The service creates a user object.

+
+ + + + + + + + + + + + + + + + + +
Request Method:POST
Output format:a JSON document of the following format, documenting the successful creation of the user object
+ 
{"username":"abc","access_token":"gISIhDNIFoXEVxzefrKUcXYOFKwBfq1xDPfv4wQdDjA="}
+
Mandatory parameters: +
username
+
email
+
password
+
fullName
+
company
+
Example:curl -X PUT "http://127.0.0.1:8888/security/api/restsecurity/user?username=uhl&email=axel.uhl@sap.com&password=abcabc&fullName=Axel%20Uhl&company=SAP%20SE"
+ Will provide a JSON document as explained above.
+ + + + + + + + + + + + + + + + + +
Request Method:PUT
Output format:a JSON document of the following format, documenting the successful creation of the user object
+ 
{"username":"abc","access_token":"gISIhDNIFoXEVxzefrKUcXYOFKwBfq1xDPfv4wQdDjA="}
+
Mandatory parameters: +
username
+
email
+
password
+
fullName
+
company
+
Example:curl -X PUT "http://127.0.0.1:8888/security/api/restsecurity/user?username=uhl&email=axel.uhl@sap.com&password=abcabc&fullName=Axel%20Uhl&company=SAP%20SE"
+ Will provide a JSON document as explained above.
+ + + + + + + + + + + + + + + + + +
Request Method:PUT
Output format:a JSON document of the following format, documenting the successful creation of the user object
+ 
{"username":"abc","access_token":"gISIhDNIFoXEVxzefrKUcXYOFKwBfq1xDPfv4wQdDjA="}
+
Mandatory parameters: +
username
+
email
+
password
+
fullName
+
company
+
Example:curl -X PUT "http://127.0.0.1:8888/security/api/restsecurity/user?username=uhl&email=axel.uhl@sap.com&password=abcabc&fullName=Axel%20Uhl&company=SAP%20SE"
+ Will provide a JSON document as explained above.
+ + + + + + + + + + + + + + + + + +
Request Method:DELETE
Output format:An Empty response with status code 200 in case of success; error-indicating status codes otherwise +
Mandatory parameters: +
username
+
Example:curl -X DELETE "http://127.0.0.1:8888/security/api/restsecurity/user?username=uhl"
+ + diff --git a/java/com.sap.sse.security/webservices/api/forgot_password.html b/java/com.sap.sse.security/webservices/api/forgot_password.html new file mode 100755 index 00000000000..ae3a615b656 --- /dev/null +++ b/java/com.sap.sse.security/webservices/api/forgot_password.html @@ -0,0 +1,118 @@ + + + + + + + + SAP Sponsorships Engine Security Webservices API + + +

SAP Sponsorships Engine Security Webservices API

+

URL: /api/restsecurity/forgot_password

+ +Description: +

Allows password recovery by means of resetting the current password and sending an e-mail +with a recovery link, all possible only if the user has a validated e-mail address.

+
+ + + + + + + + + + + + + + + + + + +
Request Method:POST
Output format:Output format:An Empty response with status code 200 in case of success; error-indicating status codes otherwise +
One of username and email must be specified: +
username
+
email
+
Example:curl -X POST "http://127.0.0.1:8888/security/api/restsecurity/forgot_password?username=uhl"
+ Will provide a JSON document as explained above.
+ + + + + + + + + + + + + + + + + +
Request Method:PUT
Output format:a JSON document of the following format, documenting the successful creation of the user object
+ 
{"username":"abc","access_token":"gISIhDNIFoXEVxzefrKUcXYOFKwBfq1xDPfv4wQdDjA="}
+
Mandatory parameters: +
username
+
email
+
password
+
fullName
+
company
+
Example:curl -X PUT "http://127.0.0.1:8888/security/api/restsecurity/user?username=uhl&email=axel.uhl@sap.com&password=abcabc&fullName=Axel%20Uhl&company=SAP%20SE"
+ Will provide a JSON document as explained above.
+ + + + + + + + + + + + + + + + + +
Request Method:PUT
Output format:a JSON document of the following format, documenting the successful creation of the user object
+ 
{"username":"abc","access_token":"gISIhDNIFoXEVxzefrKUcXYOFKwBfq1xDPfv4wQdDjA="}
+
Mandatory parameters: +
username
+
email
+
password
+
fullName
+
company
+
Example:curl -X PUT "http://127.0.0.1:8888/security/api/restsecurity/user?username=uhl&email=axel.uhl@sap.com&password=abcabc&fullName=Axel%20Uhl&company=SAP%20SE"
+ Will provide a JSON document as explained above.
+ + + + + + + + + + + + + + + + + +
Request Method:DELETE
Output format:An Empty response with status code 200 in case of success; error-indicating status codes otherwise +
Mandatory parameters: +
username
+
Example:curl -X DELETE "http://127.0.0.1:8888/security/api/restsecurity/user?username=uhl"
+ + diff --git a/java/com.sap.sse.security/webservices/api/index.html b/java/com.sap.sse.security/webservices/api/index.html index ed37dfd0078..4e53b2fecea 100755 --- a/java/com.sap.sse.security/webservices/api/index.html +++ b/java/com.sap.sse.security/webservices/api/index.html @@ -27,20 +27,32 @@ be http://sapsailing.com/security/api/restsecurity/login. - /api/restsecurity/login - Log in a subject + /api/restsecurity/create_user + Create a user - /api/restsecurity/logout - Log out a subject + /api/restsecurity/change_password + Change a user's password + + + /api/restsecurity/forgot_password + Trigger the process of password recovery + + + /api/restsecurity/user + Read, update or delete a user + + + /api/restsecurity/access_token + Obtain a bearer access token /api/restsecurity/hello Test that a subject is authenticated - /api/restsecurity/access_token - Obtain a bearer access token + /api/restsecurity/remove_access_token + Remove an existing access token, rendering it invalid for authenticating to the server diff --git a/java/com.sap.sse.security/webservices/api/user.html b/java/com.sap.sse.security/webservices/api/user.html new file mode 100755 index 00000000000..acf22232516 --- /dev/null +++ b/java/com.sap.sse.security/webservices/api/user.html @@ -0,0 +1,91 @@ + + + + + + + + SAP Sponsorships Engine Security Webservices API + + +

SAP Sponsorships Engine Security Webservices API

+

URL: /api/restsecurity/user

+ +Description: +

The service creates reads, updates or deletes a user object, based on the HTTP method used. This endpoint +cannot be used to update the password. See change_password.

+
+ + + + + + + + + + + + + + + + + +
Request Method:PUT
Output format:a JSON document of the following format, documenting the successful creation of the user object
+ 
{"username":"abc","access_token":"gISIhDNIFoXEVxzefrKUcXYOFKwBfq1xDPfv4wQdDjA="}
+
Mandatory parameters: +
username
+
email
+
fullName
+
company
+
Example:curl -X PUT "http://127.0.0.1:8888/security/api/restsecurity/user?username=uhl&email=axel.uhl@sap.com&fullName=Axel%20Uhl&company=SAP%20SE"
+ Will provide a JSON document as explained above.
+ + + + + + + + + + + + + + + + + +
Request Method:GET
Output format:a JSON document of the following format
+ 
{"username":"abc","access_token":"gISIhDNIFoXEVxzefrKUcXYOFKwBfq1xDPfv4wQdDjA="}
+
Optional parameter: +
username
If provided, the record for the user with that name will be shown. This requires this + user to be the currently authenticated subject, or the authenticated subject needs to + have administrator permissions. +
Example:curl "http://admin:admin@127.0.0.1:8888/security/api/restsecurity/user?username=uhl"
+ Will provide a JSON document as explained above.
+ + + + + + + + + + + + + + + + + +
Request Method:DELETE
Output format:An Empty response with status code 200 in case of success; error-indicating status codes otherwise +
Mandatory parameters: +
username
+
Example:curl -X DELETE "http://admin:admin@127.0.0.1:8888/security/api/restsecurity/user?username=uhl"
+ + From 8262ec36afa9f162b754434f59afa10f0909a8b4 Mon Sep 17 00:00:00 2001 From: Axel Uhl Date: Mon, 31 Jul 2017 18:22:04 +0200 Subject: [PATCH 2/4] fixed ADMIN check in user management service Change-Id: I0d1c1eb4822423801d67cb827b3cb13c1c2b35e8 --- .../sap/sse/security/ui/server/UserManagementServiceImpl.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java index 5dbe9b07b03..6b08f255abd 100644 --- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java +++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java @@ -171,7 +171,7 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U private void ensureThatUserInQuestionIsLoggedInOrCurrentUserIsAdmin(String username) throws UserManagementException { final Subject subject = SecurityUtils.getSubject(); // the signed-in subject has role ADMIN or is changing own user - if (!subject.hasRole(DefaultRoles.ADMIN.name()) && (subject.getPrincipal() == null + if (!subject.hasRole(DefaultRoles.ADMIN.getRolename()) && (subject.getPrincipal() == null || !username.equals(subject.getPrincipal().toString()))) { throw new UserManagementException(UserManagementException.INVALID_CREDENTIALS); } From e2c9bcd9cff973e74cd9710b4bbe55c65b9aaa13 Mon Sep 17 00:00:00 2001 From: Axel Uhl Date: Wed, 2 Aug 2017 15:35:41 +0200 Subject: [PATCH 3/4] re-added the phony /api/restsecurity/login URL into shiro.ini Change-Id: Ic2f10e2cedb374b3f918571b157aa4bbdeceb17f --- java/com.sap.sse.security/resources/shiro.ini | 1 + 1 file changed, 1 insertion(+) diff --git a/java/com.sap.sse.security/resources/shiro.ini b/java/com.sap.sse.security/resources/shiro.ini index 85c926e3e34..52e28cd875d 100644 --- a/java/com.sap.sse.security/resources/shiro.ini +++ b/java/com.sap.sse.security/resources/shiro.ini @@ -66,6 +66,7 @@ bearerToken = com.sap.sse.security.BearerTokenOrBasicOrFormAuthenticationFilter # Specifying filter chains for URL patterns [urls] +/api/restsecurity/login = authc /api/restsecurity/user = bearerToken /api/restsecurity/change_password = bearerToken /api/restsecurity/logout = logout From 6959b0db07149f6660be4cd32e585ed149191114 Mon Sep 17 00:00:00 2001 From: Axel Uhl Date: Wed, 2 Aug 2017 15:36:28 +0200 Subject: [PATCH 4/4] added comment for /login URL configuration Change-Id: I2d7fb5eb717dd30b04ea546d2f54ab5adf5e8916 --- java/com.sap.sse.security/resources/shiro.ini | 1 + 1 file changed, 1 insertion(+) diff --git a/java/com.sap.sse.security/resources/shiro.ini b/java/com.sap.sse.security/resources/shiro.ini index 52e28cd875d..c460a96ab90 100644 --- a/java/com.sap.sse.security/resources/shiro.ini +++ b/java/com.sap.sse.security/resources/shiro.ini @@ -66,6 +66,7 @@ bearerToken = com.sap.sse.security.BearerTokenOrBasicOrFormAuthenticationFilter # Specifying filter chains for URL patterns [urls] +# Note: the following login URL does nothing but trigger the authc filter; required for Selenium testing /api/restsecurity/login = authc /api/restsecurity/user = bearerToken /api/restsecurity/change_password = bearerToken