[OSGi] Support JAAS auth in Jetty #41
Conversation
|
|
||
| @Path("/") | ||
| @Produces(MediaType.APPLICATION_JSON) | ||
| public class HaMasterCheckResource { |
There was a problem hiding this comment.
maybe call this TestingHaMasterCheckResource (or even DummyTestingResource and change the paths so they don't mimic real ones?)
There was a problem hiding this comment.
Renamed with a Testing prefix at neykov@25ff234. Can't use the more generic name because there are a few of them.
/server/shutdown needs to be fixed, because it's testing HaHotCheckResourceFilter.isMasterRequiredForRequest behaviour. The other paths are made up.
|
looks reasonable. should we deprecate the old mechanism for handling logout, or at least comment pointing to the new one? |
|
Previous logout mechanism lives at |
neykov
force-pushed
the
jetty-jaas
branch
2 times, most recently
from
1d488ad to
a8b2c01
Compare
|
Added two additional commits addressing problems that came up during testing. |
|
Fixed newly introduced conflicts here and #31 |
|
Triggering a rebuild |
|
Jenkins didn't even start a build for this one, weird. #55 includes the changes from here and is successful. |
|
Tested this along with #31 & #55 ... noticed the following Works as expected with the following in your OR but leaving the above out |
An implementation of a JAAS LoginModule, delegating to the SecurityProvider configured in brooklyn.properties. Used as the authentication mechanism for the REST API when running in Karaf. Currently configured as a separate realm, used only for web.
* Implement an OSGi fragment so PAX-WEB code can load Jetty classes dynamically * Default jetty.xml for karaf, registering the BrooklynLoginModule JAAS implementation * Register JaasLoginService programatically in classical launcher * Add support for roles in BrooklynLoginModule * Register a default jaas.conf for classical launcher if one not already registered externally * Configure Karaf Jetty to listen on port 8081
…ourceFilter (JAX-RS) Move over missing functionality and deprecate HaMasterCheckFilter.
Support adding the provider in web.xml files. If no management context passed in the constructor look for it in the servlet context.
…into various JAX-RS parts * LogoutApi & LogoutResource * RequestTaggingRsFilter - still need a servlet version of it because of the LoggingFilter, so get the tag from the request if one is present, generate otherwise * EntitlementContextFilter - initialise thread request entitlements * Support identical functionality in Jersey * Deprecate BrooklynPropertiesSecurityFilter
Instead add a new property skipSecurity corresponding to the "--noConsoleSecurity" cli option.
Explicitly disable web server authentication for tests that don't need it.
|
Thanks for testing this @m4rkmckenna. Addressed comment in #69 (not directly related to this PR). |
|
Also rebased all related PRs to resolve merge conflicts. |
Add a Riak backed web cluster upon swarm, and unit tests.
4 participants
Replace BrooklynPropertiesSecurityFilter with JAX-RS functionality.
Depends on #31, merge together with apache/brooklyn-ui#10