Bug 4963: Activated shiro in com.sap.sse.replication to be able to

implemen permission checks in ReplicationServlet/ReplicationServiceImpl

java/com.sap.sse.replication/.classpath

@@ -3,5 +3,6 @@
 	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.8"/>
 	<classpathentry kind="con" path="org.eclipse.pde.core.requiredPlugins"/>
 	<classpathentry kind="src" path="src"/>
+	<classpathentry kind="src" path="resources"/>
 	<classpathentry kind="output" path="bin"/>
 </classpath>

java/com.sap.sse.replication/META-INF/MANIFEST.MF

@@ -14,12 +14,16 @@ Require-Bundle: com.sap.sse.common,
  lz4-java;bundle-version="1.3.0",
  org.apache.commons.lang,
  com.sap.sse.replication.interfaces;bundle-version="1.0.0",
- org.json.simple
+ org.json.simple,
+ com.sap.sse.security,
+ com.sap.sse.security.common,
+ com.sap.sse.security.interface,
+ org.apache.shiro.core,
+ org.apache.shiro.web
 Bundle-ClassPath: .
 Comment: The Web-ContextPath is referred to by ReplicationMasterDescriptorImpl.REPLICATION_SERVLET
 Web-ContextPath: /replication
 Import-Package: com.rabbitmq.client;version="2.8.4",
- com.sap.sse.security.util,
  javax.servlet;version="2.6.0",
  javax.servlet.http;version="2.6.0",
  org.osgi.framework;version="1.6.0",

java/com.sap.sse.replication/WEB-INF/web.xml

@@ -15,6 +15,32 @@
 			<param-value>false</param-value>
 		</init-param>
 	</servlet>
+	
+    <context-param>
+        <param-name>shiroEnvironmentClass</param-name>
+        <param-value>org.apache.shiro.web.env.IniWebEnvironment</param-value>
+    </context-param>
+    
+        <!-- Apache Shiro -->
+    
+    <listener>
+        <listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
+    </listener>
+    <filter>
+        <filter-name>ShiroFilter</filter-name>
+        <filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
+    </filter>
+    <!-- Make sure any request you want accessible to Shiro is filtered. "/*" 
+         catches all requests. Usually this filter mapping is defined first (before all 
+         others) to ensure that Shiro works in subsequent filters in the filter chain: -->
+    <filter-mapping>
+        <filter-name>ShiroFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+        <dispatcher>REQUEST</dispatcher>
+        <dispatcher>FORWARD</dispatcher>
+        <dispatcher>INCLUDE</dispatcher>
+        <dispatcher>ERROR</dispatcher>
+    </filter-mapping>
 
 	<servlet>
 		<servlet-name>Replication</servlet-name>

java/com.sap.sse.replication/build.properties

@@ -1,4 +1,5 @@
-source.. = src/
+source.. = src/,\
+           resources/
 output.. = bin/
 bin.includes = META-INF/,\
                .,\

java/com.sap.sse.replication/resources/shiro.ini

@@ -0,0 +1,45 @@
+
+[main]
+credentialsMatcher = org.apache.shiro.authc.credential.Sha256CredentialsMatcher
+credentialsMatcher.storedCredentialsHexEncoded = false
+credentialsMatcher.hashIterations = 1024
+
+# Realm configuration:
+# --------------------
+
+upRealm = com.sap.sse.security.UsernamePasswordRealm
+upRealm.credentialsMatcher = $credentialsMatcher
+oauthRealm = com.sap.sse.security.OAuthRealm
+bearerTokenRealm = com.sap.sse.security.BearerTokenRealm
+
+# Putting it all together:
+sessionManager = com.sap.sse.security.SecurityWebSessionManager
+securityManager.sessionManager = $sessionManager
+sessionDAO = org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO
+securityManager.sessionManager.sessionDAO = $sessionDAO
+subjectDAO = com.sap.sse.security.NoSessionStorageSessionDAO
+securityManager.subjectDAO = $subjectDAO
+# 1y timeout
+securityManager.sessionManager.globalSessionTimeout = 31536000000
+cacheManager = com.sap.sse.security.SessionCacheManager
+securityManager.cacheManager = $cacheManager
+
+# Support for anonymous user permissions
+webSubjectFactoryWithAnonymousPrincipalSupport=com.sap.sse.security.WebSubjectFactoryWithAnonymousPrincipalSupport
+securityManager.subjectFactory=$webSubjectFactoryWithAnonymousPrincipalSupport
+
+# Authentication Filter Configurations
+# ------------------------------------
+
+# This authentication filter accepts a bearer access token in the HTTP
+# Authorization header field, as in
+#   Authorization: Bearer 1029741026501365024376093245
+# If no such bearer token is provided, the filter falls back to basic HTTP
+# authentication ("Authentication: Basic ...") and then regular form-based
+# authentication with POST parameters "username" and "password".
+bearerToken = com.sap.sse.security.BearerTokenOrBasicOrFormAuthenticationFilter
+
+# Specifying filter chains for URL patterns
+
+[urls]
+/replication = bearerToken