From 1a96cb363c87ec7c2e3caff407289dcfd323e31b Mon Sep 17 00:00:00 2001 From: Endi Sukma Dewata Date: Fri, 1 Feb 2013 13:05:38 -0500 Subject: Added authentication method validation. A new mechanism has been added to limit the authentication methods that can be used to invoke the REST methods. The AuthMethodMapping annotation maps each REST method to a list of allowed authentication methods defined auth-method.properties. When a client calls a REST method, the AuthMethod- Interceptor will intercept the call and verify that the client uses an allowed authentication method. For security reason, most REST methods that require authentication have been configured to require client certificate authentication. Authentication using username and password will only be used to get the installation token from security domain. The auth.properties have been renamed to acl.properties since it's used to store ACL mappings. Ticket #477 --- base/tks/shared/webapps/tks/WEB-INF/acl.properties | 10 ++++++++++ base/tks/shared/webapps/tks/WEB-INF/auth-method.properties | 9 +++++++++ base/tks/shared/webapps/tks/WEB-INF/auth.properties | 10 ---------- 3 files changed, 19 insertions(+), 10 deletions(-) create mode 100644 base/tks/shared/webapps/tks/WEB-INF/acl.properties create mode 100644 base/tks/shared/webapps/tks/WEB-INF/auth-method.properties delete mode 100644 base/tks/shared/webapps/tks/WEB-INF/auth.properties (limited to 'base/tks/shared/webapps') diff --git a/base/tks/shared/webapps/tks/WEB-INF/acl.properties b/base/tks/shared/webapps/tks/WEB-INF/acl.properties new file mode 100644 index 000000000..62367135e --- /dev/null +++ b/base/tks/shared/webapps/tks/WEB-INF/acl.properties @@ -0,0 +1,10 @@ +# Restful API authorization mapping info +# +# Format: +# = , +# ex: admin.users = certServer.ca.users,read + +account.login = certServer.tks.account,login +account.logout = certServer.tks.account,logout +admin.users = certServer.tks.users,execute +admin.groups = certServer.tks.groups,execute diff --git a/base/tks/shared/webapps/tks/WEB-INF/auth-method.properties b/base/tks/shared/webapps/tks/WEB-INF/auth-method.properties new file mode 100644 index 000000000..81e24403f --- /dev/null +++ b/base/tks/shared/webapps/tks/WEB-INF/auth-method.properties @@ -0,0 +1,9 @@ +# Restful API auth mapping info +# +# Format: +# = +# ex: admin.users = certUserDBAuthMgr,passwdUserDBAuthMgr + +default = * +account = certUserDBAuthMgr,passwdUserDBAuthMgr +admin = certUserDBAuthMgr diff --git a/base/tks/shared/webapps/tks/WEB-INF/auth.properties b/base/tks/shared/webapps/tks/WEB-INF/auth.properties deleted file mode 100644 index 6de7f08e5..000000000 --- a/base/tks/shared/webapps/tks/WEB-INF/auth.properties +++ /dev/null @@ -1,10 +0,0 @@ -# Restful API auth/authz mapping info -# -# Format: -# = , -# ex: admin.users = certServer.ca.users,read - -account.login = certServer.tks.account,login -account.logout = certServer.tks.account,logout -admin.users = certServer.tks.users,execute -admin.groups = certServer.tks.groups,execute -- cgit