[keycloak-user] Sub-resource authentication (edge case)

[Eric Wittmann]

In apiman I have a bit of an edge case that currently isn't working as I 
was hoping (running in wildfly 8.2 - not tested on any other platform).

The issue is that I have a WAR with two sub-contexts:

/api - JAX-RS endpoints to configure the API Gateway
/gateway - the API Gateway (reverse proxy)

I wanted /api to be protected by keycloak, but for /gateway to be 
unprotected.

My web.xml looks like this:

   <security-constraint>
     <web-resource-collection>
       <web-resource-name>apiman-gateway</web-resource-name>
       <url-pattern>/api/*</url-pattern>
     </web-resource-collection>
     <auth-constraint>
       <role-name>apiadmin</role-name>
     </auth-constraint>
   </security-constraint>
   <login-config>
     <auth-method>BASIC</auth-method>
     <realm-name>apiman</realm-name>
   </login-config>
   <security-role>
     <role-name>apiadmin</role-name>
   </security-role>


It all works great until I send a request to /gateway/* that includes an 
"Authorization" http header.  If I do that, the adapter tries to 
authenticate with those credentials and fails with a 401 if they don't 
match (which they don't).

I realize this is an odd case, but I did expect that if the web.xml 
specified that only /api/* were protected then other paths would simply 
pass through any Authorization headers.  That may be an incorrect 
expectation - not sure what the servlet spec requires in this case.

Thoughts?

Currently I'm probably going to work around this by splitting up the API 
and Gateway servlets into separate WARs.

-Eric