[gateway/management-api] http core services should not enforce basic authentication

[blackfich]

the new HTTP core services should not enforce authentication. One should be able to disable authentication from setting in conf file

Expected Behavior

when services.core.http.authentication.type is set to none no authentication should be required

Current Behavior

currently basic authentication is hardcoded and does not take into account the type of authentication

Possible Solution

when services.core.http.authentication.type is set to none , don't attach any AuthHandler to the mainRouter and nodeRouter routes

retrieve authentication type from config file:

@Value("${services.core.http.authentication.type:basic}")
private String authenticationType;

act on it:

AuthHandler authHandler = null;
switch ( authenticationType.toLowerCase() ) {
   case "none":
      break;
   case "basic":
      authHandler = BasicAuthHandler.create(authProvider, "gravitee.io");
      break;
   default:
      throw new IllegalArgumentException("Unsupported Authentication type " + authenticationType + " for HTTP core services");
}

// Set security handler is defined
if ( authHandler != null ) {
   mainRouter.route().handler(authHandler);
   nodeRouter.route().handler(authHandler);
}

Context

We want to use the new health check ability but without the need for authentication (the port it is on is not exposed to the outside world)

Your Environment

• Version used: 1.9.0
• Browser Name and version: N/A
• Operating System and version: CentOS/7

[blackfich]

I will propose au PR next week regarding this new feature