Fix using enterprise built-in procedures over REST

community/server/src/main/java/org/neo4j/server/CommunityNeoServer.java

@@ -79,7 +79,7 @@ protected Iterable<ServerModule> createServerModules()
                 new ThirdPartyJAXRSModule( webServer, getConfig(), logProvider, this ),
                 new ConsoleModule( webServer, getConfig() ),
                 new Neo4jBrowserModule( webServer ),
-                new AuthorizationModule( webServer, authManagerSupplier, logProvider, getConfig(), getUriWhitelist() ),
+                createAuthorizationModule(),
                 new SecurityRulesModule( webServer, getConfig(), logProvider ) );
     }
 
@@ -98,4 +98,9 @@ public Iterable<AdvertisableService> getServices()
 
         return toReturn;
     }
+
+    protected AuthorizationModule createAuthorizationModule()
+    {
+        return new AuthorizationModule( webServer, authManagerSupplier, logProvider, getConfig(), getUriWhitelist() );
+    }
 }

community/server/src/main/java/org/neo4j/server/modules/AuthorizationModule.java

@@ -60,7 +60,7 @@ public void start()
         }
         else
         {
-            authorizationFilter = new AuthorizationDisabledFilter();
+            authorizationFilter = createAuthorizationDisabledFilter();
         }
 
         webServer.addFilter( authorizationFilter, "/*" );
@@ -70,4 +70,9 @@ public void start()
     public void stop()
     {
     }
+
+    protected AuthorizationDisabledFilter createAuthorizationDisabledFilter()
+    {
+        return new AuthorizationDisabledFilter();
+    }
 }

community/server/src/main/java/org/neo4j/server/rest/dbms/AuthorizationDisabledFilter.java

@@ -29,6 +29,7 @@
 
 import org.neo4j.graphdb.security.AuthorizationViolationException;
 import org.neo4j.kernel.api.security.AccessMode;
+import org.neo4j.kernel.api.security.AuthSubject;
 
 import static javax.servlet.http.HttpServletRequest.BASIC_AUTH;
 
@@ -45,11 +46,17 @@ public void doFilter( ServletRequest servletRequest, ServletResponse servletResp
 
         try
         {
-            filterChain.doFilter( new AuthorizedRequestWrapper( BASIC_AUTH, "neo4j", request, AccessMode.Static.FULL ), servletResponse );
+            filterChain.doFilter( new AuthorizedRequestWrapper( BASIC_AUTH, "neo4j", request,
+                    getAuthDisabledAccessMode() ), servletResponse );
         }
         catch ( AuthorizationViolationException e )
         {
             unauthorizedAccess( e.getMessage() ).accept( response );
         }
     }
+
+    protected AccessMode getAuthDisabledAccessMode()
+    {
+        return AuthSubject.AUTH_DISABLED;
+    }
 }

enterprise/server-enterprise/src/main/java/org/neo4j/server/enterprise/EnterpriseNeoServer.java

@@ -43,7 +43,9 @@
 import org.neo4j.server.CommunityNeoServer;
 import org.neo4j.server.database.Database;
 import org.neo4j.server.database.LifecycleManagingDatabase.GraphFactory;
+import org.neo4j.server.enterprise.modules.EnterpriseAuthorizationModule;
 import org.neo4j.server.enterprise.modules.JMXManagementModule;
+import org.neo4j.server.modules.AuthorizationModule;
 import org.neo4j.server.modules.ServerModule;
 import org.neo4j.server.rest.DatabaseRoleInfoServerModule;
 import org.neo4j.server.rest.MasterInfoService;
@@ -157,6 +159,13 @@ public int idleThreads()
         return webServer;
     }
 
+    @Override
+    protected AuthorizationModule createAuthorizationModule()
+    {
+        return new EnterpriseAuthorizationModule( webServer, authManagerSupplier, logProvider, getConfig(),
+                getUriWhitelist() );
+    }
+
     @SuppressWarnings( "unchecked" )
     @Override
     protected Iterable<ServerModule> createServerModules()

enterprise/server-enterprise/src/main/java/org/neo4j/server/enterprise/modules/EnterpriseAuthorizationModule.java

@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2002-2016 "Neo Technology,"
+ * Network Engine for Objects in Lund AB [http://neotechnology.com]
+ *
+ * This file is part of Neo4j.
+ *
+ * Neo4j is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.neo4j.server.enterprise.modules;
+
+import java.util.function.Supplier;
+import java.util.regex.Pattern;
+
+import org.neo4j.kernel.api.security.AuthManager;
+import org.neo4j.kernel.configuration.Config;
+import org.neo4j.logging.LogProvider;
+import org.neo4j.server.modules.AuthorizationModule;
+import org.neo4j.server.rest.dbms.AuthorizationDisabledFilter;
+import org.neo4j.server.rest.dbms.EnterpriseAuthorizationDisabledFilter;
+import org.neo4j.server.web.WebServer;
+
+public class EnterpriseAuthorizationModule extends AuthorizationModule
+{
+    public EnterpriseAuthorizationModule( WebServer webServer,
+            Supplier<AuthManager> authManager,
+            LogProvider logProvider, Config config,
+            Pattern[] uriWhitelist )
+    {
+        super( webServer, authManager, logProvider, config, uriWhitelist );
+    }
+
+    @Override
+    protected AuthorizationDisabledFilter createAuthorizationDisabledFilter()
+    {
+        return new EnterpriseAuthorizationDisabledFilter();
+    }
+}

enterprise/server-enterprise/src/main/java/org/neo4j/server/rest/dbms/EnterpriseAuthorizationDisabledFilter.java

@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2002-2016 "Neo Technology,"
+ * Network Engine for Objects in Lund AB [http://neotechnology.com]
+ *
+ * This file is part of Neo4j.
+ *
+ * Neo4j is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.neo4j.server.rest.dbms;
+
+import org.neo4j.kernel.api.security.AccessMode;
+import org.neo4j.kernel.enterprise.api.security.EnterpriseAuthSubject;
+
+public class EnterpriseAuthorizationDisabledFilter extends AuthorizationDisabledFilter
+{
+    @Override
+    protected AccessMode getAuthDisabledAccessMode()
+    {
+        return EnterpriseAuthSubject.AUTH_DISABLED;
+    }
+}

enterprise/server-enterprise/src/test/java/org/neo4j/server/rest/security/EnterpriseAuthenticationDocIT.java

@@ -73,4 +73,34 @@ public void shouldHavePredefinedRoles() throws Exception
                 hasItems( "admin", "architect", "publisher", "reader") );
 
     }
+
+    @Test
+    public void shouldAllowExecutingEnterpriseBuiltInProceduresWithAuthDisabled() throws Exception
+    {
+        // Given
+        startServerWithAuthDisabled();
+
+        // When
+        String method = "POST";
+        String path = "db/data/transaction/commit";
+        HTTP.RawPayload payload = HTTP.RawPayload.quotedJson(
+                "{'statements':[{'statement':'CALL dbms.listQueries()'}]}" );
+        HTTP.Response response = HTTP.request( method, server.baseUri().resolve( path ).toString(), payload );
+
+        // Then
+        assertThat(response.status(), equalTo(200));
+        ArrayNode errors = (ArrayNode) response.get("errors");
+        assertThat( "Should have no errors", errors.size(), equalTo( 0 ) );
+        ArrayNode results = (ArrayNode) response.get("results");
+        ArrayNode data = (ArrayNode) results.get(0).get("data");
+        assertThat( "Should see our own query", data.size(), equalTo( 1 ) );
+    }
+
+    private void startServerWithAuthDisabled() throws IOException
+    {
+        server = EnterpriseServerBuilder.server()
+                .withProperty( GraphDatabaseSettings.auth_enabled.name(), Boolean.toString( false ) )
+                .build();
+        server.start();
+    }
 }