Issue Type: Feature Request Feature Request
Affects Versions: 1.1.0
Assignee: Unassigned
Components: authorization
Created: 27/Jun/13 10:49 AM
Description:

when someone, NOT logged in, tries to access a HTTP endpoint, decorated with our @Secure annotation ([1]), the Interceptor behind the annotation throws the RestEasy "UnauthorizedException" exception ([2]), which our HttpExceptionMapper converts into a 401 response ([3]).

This all is perfect!!

However, when someone, that IS logged in, tries to access a HTTP endpoint where he does NOT have the proper roles, the "identityManagement.hasRoles(roles);" throws a "org.picketlink.idm.IdentityManagementException":

Caused by: org.picketlink.idm.IdentityManagementException: PLIDM000059: Could not query Relationship using query [org.picketlink.idm.query.internal.DefaultRelationshipQuery@6f3999ad].
	at org.picketlink.idm.query.internal.DefaultRelationshipQuery.getResultList(DefaultRelationshipQuery.java:93) [picketlink-idm-impl-2.5.0.Beta4.jar:]
	at org.picketlink.idm.internal.DefaultIdentityManager.getGrant(DefaultIdentityManager.java:529) [picketlink-idm-impl-2.5.0.Beta4.jar:]
	at org.picketlink.idm.internal.DefaultIdentityManager.hasRole(DefaultIdentityManager.java:348) [picketlink-idm-impl-2.5.0.Beta4.jar:]
	at org.picketlink.internal.SecuredIdentityManager.hasRole(SecuredIdentityManager.java:141) [picketlink-impl-2.5.0.Beta4.jar:]
	at org.jboss.aerogear.security.picketlink.authz.IdentityManagementImpl.hasRoles(IdentityManagementImpl.java:135) [aerogear-security-picketlink-1.0.1.jar:1.0.1]
	at org.jboss.aerogear.security.picketlink.authz.IdentityManagementImpl$Proxy$_$$_WeldClientProxy.hasRoles(IdentityManagementImpl$Proxy$_$$_WeldClientProxy.java) [aerogear-security-picketlink-1.0.1.jar:1.0.1]

Since the "IdentityManagementException" is not caught, we do get a 400/Bad Request response.

Sure, a try/catch statement around the "identityManagement.hasRoles(roles);" could catch all underlying IDM exceptions, turning them into a 401 response , however not sure that is fine grained enough.

[1] https://github.com/aerogear/aerogear-security/blob/master/src/main/java/org/jboss/aerogear/security/authz/Secure.java
[2] https://github.com/aerogear/aerogear-security/blob/master/src/main/java/org/jboss/aerogear/security/interceptor/SecurityInterceptor.java#L72
[3] https://github.com/aerogear/aerogear-security/blob/master/src/main/java/org/jboss/aerogear/security/exception/HttpExceptionMapper.java#L41-L43
[4] https://github.com/aerogear/aerogear-security/blob/master/src/main/java/org/jboss/aerogear/security/interceptor/SecurityInterceptor.java#L69
Fix Versions: 1.1.0
Project: AeroGear Security
Priority: Major Major
Reporter: Matthias Wessendorf
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira