[Hawkular-dev] What are your Authentication and Authorization needs?

[Juraci Paixão Kröhling]

On 22.04.2016 13:47, Juraci Paixão Kröhling wrote:
> Due to the changes in requirements for Hawkular, I'm collecting the
> needs we have around authentication and authorization.

It seems we have very simple needs on this front. From what I could 
gather, all we need is to support two roles: read-write and read-only .

So, it's safe to assume that your component will be protected via JAAS 
and that the Principal will either be in the "read-only" role or will 
have both "read-only" and "read-write" roles. This means, of course, 
that you can (or even, that you should) make use of the JAAS API and 
annotations to protect your backend endpoints, such as @RolesAllowed or 
HttpServletRequest#getUserPrincipal() .

- Juca.