fixed security configuration of windestimation web bundle

Change-Id: Ide0b3ea9afbb8f4e110504c2034b29386a3cc5ce

java/com.sap.sailing.windestimation/META-INF/MANIFEST.MF

@@ -10,12 +10,12 @@ Require-Bundle: org.eclipse.osgi;bundle-version="3.10.1",
  org.mongodb.mongo-java-driver;bundle-version="3.6.4",
  org.apache.httpcomponents.httpclient;bundle-version="[4.2.5,4.3.0)",
  org.apache.httpcomponents.httpcore;bundle-version="[4.0.0,4.3.0)",
- com.sap.sse;bundle-version="1.0.0",
- com.sap.sse.common;bundle-version="1.0.0",
+ com.sap.sse,
+ com.sap.sse.common,
  com.sap.sailing.domain.shared.android,
  com.sap.sailing.domain.common,
- com.sap.sailing.server.gateway.serialization;bundle-version="1.0.0",
- com.sap.sailing.server.gateway.serialization.shared.android;bundle-version="1.0.0",
+ com.sap.sailing.server.gateway.serialization,
+ com.sap.sailing.server.gateway.serialization.shared.android,
  com.sap.sailing.polars,
  org.apache.commons.io,
  com.sap.sse.replication,
@@ -33,7 +33,8 @@ Require-Bundle: org.eclipse.osgi;bundle-version="3.10.1",
  org.apache.shiro.ehcache;bundle-version="1.2.3",
  com.sun.xml.bind.jaxb-impl;bundle-version="2.3.0",
  com.sap.sse.security,
- com.sap.sse.security.common
+ com.sap.sse.security.common,
+ com.sap.sailing.server
 Import-Package: javax.ws.rs;version="1.1.1",
  javax.ws.rs.core;version="1.1.1",
  javax.xml.bind,

java/com.sap.sailing.windestimation/resources/shiro.ini

@@ -7,14 +7,10 @@ credentialsMatcher.hashIterations = 1024
 # Realm configuration:
 # --------------------
 
-permissionsForRoleProvider = com.sap.sailing.domain.common.security.SailingPermissionsForRoleProvider
 upRealm = com.sap.sse.security.UsernamePasswordRealm
 upRealm.credentialsMatcher = $credentialsMatcher
-upRealm.permissionsForRoleProvider = $permissionsForRoleProvider
 oauthRealm = com.sap.sse.security.OAuthRealm
-oauthRealm.permissionsForRoleProvider = $permissionsForRoleProvider
 bearerTokenRealm = com.sap.sse.security.BearerTokenRealm
-bearerTokenRealm.permissionsForRoleProvider = $permissionsForRoleProvider
 
 # Putting it all together:
 sessionManager = com.sap.sse.security.SecurityWebSessionManager
@@ -28,6 +24,10 @@ securityManager.sessionManager.globalSessionTimeout = 31536000000
 cacheManager = com.sap.sse.security.SessionCacheManager
 securityManager.cacheManager = $cacheManager
 
+# Support for anonymous user permissions
+webSubjectFactoryWithAnonymousPrincipalSupport=com.sap.sse.security.WebSubjectFactoryWithAnonymousPrincipalSupport
+securityManager.subjectFactory=$webSubjectFactoryWithAnonymousPrincipalSupport
+
 # Authentication Filter Configurations
 # ------------------------------------
 
@@ -59,16 +59,13 @@ authc.successUrl = /api/restsecurity/hello
 # If no such bearer token is provided, the filter falls back to basic HTTP
 # authentication ("Authentication: Basic ...") and then regular form-based
 # authentication with POST parameters "username" and "password".
-bearerToken = com.sap.sse.security.BearerTokenOrBasicOrFormAuthenticationFilter
+bearerToken = com.sap.sailing.server.security.BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing
+
+# The same as bearerToken, but with additional fallback to anonymous authentication.
+# In this case sufficient permission checks have to be done on the application side.
+bearerTokenOrAnonymous = com.sap.sailing.server.security.BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing
 
 # Specifying filter chains for URL patterns
 
 [urls]
-# Uncomment the following to require the permission "event:view" in order to use /api/v1/events:
-#/api/v1/events = bearerToken
-
-# Example: Secure access to leaderboard race column factor updates; read access should require no permissions
-#/api/v1/leaderboards/*/racecolumnfactors/** = bearerToken
-
-# Example: Secure the access (in particular the POST/write access) to posting race log events
-#/rc/racelog = bearerToken
+/api/** = bearerTokenOrAnonymous