Support Basic Auth for a server

[bdw429s]

https://github.com/undertow-io/undertow/blob/master/examples/src/main/java/io/undertow/examples/security/basic/BasicAuthServer.java

If we can pass a list of usernames and passwords via a new server option to Runwar then I can wrap this up in CommandBox.

[yukido]

I strongly support this.

[denuno]

So what I went with here is an option called -users or --basicauthusers and it expects the format to be like this: bob=secret,alice=fun,equals=blah\=inpass (escape = with \=)

--basicauthusers="bob=wee,al=hoo"

There's also --basicauth-enable which you can use to turn it off even if users are specified. (Specifying users automatically turns it on otherwise.)

[bdw429s]

Excellent. Here is the CommandBox ticket for it to be incorporated
https://ortussolutions.atlassian.net/browse/COMMANDBOX-560

[bdw429s]

@denuno How should commas be escaped (likely in passwords that uses punctuation)? What do you think about using a scheme like URL encoding since there's already libs/built-ins out there for encoding/decoding for it? This would also take care of things like a double quote in a password.

--basicauthusers="bob=secret&alice=fun&equals=blah%3Dinpass&punctuation=%23%24%25%5E%26*(%2C.%2F%3C%3E%3F"

[bdw429s]

Looking at your code it seems you already accounted for commas to be passed as \, so that's cool. We can roll with this for now.

[bdw429s]

@denuno Works pretty good. Before we set this in stone, what do you think about the ability to apply basic auth to a specific sub folder or path?

1. Does Undertow support that?
2. How would the config deal with it?
3. Is it worth it?

[denuno]

For 1, we can use a PathHandler which would limit it to a path or paths, so that infrastructure exists.
For 2 & 3... well, if we could come up with something good for 2, it makes 3 more justified.

I rather like the idea of being able to plug in some auth easily. Configuration is an issue though, especially with limits on how long command lines can be and whatnot, and with various auth schema needing various types of info. I'm kinda thinking like, instead of passing various users/groups/paths/whatnot, we instead pass in a file path to a JSON file containing that info.

I'm often using various 3rd party auth providers, it would be kinda cool to have container-level support for requiring auth based on the path... I think there's even a jee spec for doing so, ish, which might give some inspiration as to some type of generic user/group/rule define'n possibilities.

[bdw429s]

From the CommandBox side of things, the setup looks like this:

{
    "web":{
        "basicAuth":{
            "users":{
                "brad":"wood",
                "lu,is":"maj=ano"
            },
            "enable":"true"
        }
    }
}

A suggestion for #2 could look like this which would leave the default whole-site protection simple.

{
    "web":{
        "basicAuth":{
            "users":{
                "brad":"wood",
            },
            paths : {
                "/foo" : {
                   "users":{
                        "foouser":"foopass",
                    }
                },
                "/admin/bar" : {
                   "users":{
                        "adminuser":"adminass",
                    }
                }
            }
            "enable":"true"
        }
    }
}

Or here's a simpler version that assumes there's nothing other than users to configure for a path:

{
    "web":{
        "basicAuth":{
            "users":{
                "brad":"wood",
            },
            paths : {
                "/foo" : {
                     "foouser":"foopass",
                },
                "/admin/bar" : {
                   "adminuser":"adminass",
               }
            }
            "enable":"true"
        }
    }
}

Of course, this is all on the CommandBox side of things. I've still got to wrap it all up and send it over to Runwar.

[bdw429s]

@denuno Someone pointed out to me today that the basic auth doesn't quite seem to be 100% yet. Once you log in, they expected the cgi.remote_user variable to have the username, but it's blank in instead. I assume some extra plumbing just needs put in to set that?

https://ortussolutions.atlassian.net/browse/COMMANDBOX-625

[bdw429s]

Looking at Undertow, I assume we need to be using this class?
https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io/undertow/attribute/RemoteUserAttribute.java