[Hawkular-dev] securing download WAR

Today we have a simple WAR [1] that lets you download the agent .zip and the agent installer: 1. Download the agent distro: http://localhost:8080/hawkular/wildfly-agent/download 2. Download the installer: http://localhost:8080/hawkular/wildfly-agent/download?installer=true That second one you can submit a FORM POST with some additional installer config settings. In fact, that /download URL points to a single servlet - its just if you POST with "installer=true" (or pass it in as a GET query string) you'll get the installer instead. We could change this if need by (say "/download" for the agent distro, and "/installer" for the installer). The question I have is - what do I need to do to get that second one "secured" with an Accounts login? We want to keep the "/download" URL such that it doesn't require a user/pass just to serve the agent distro zip (that is just the same one you build via mvn - there is nothing that needs to be secured here - plus, the installer needs to download it later and we don't want to have the installer log in just to download the zip). But that second one, we are going to need the Accounts credentials because the installer will need to do things like create an offline token for the user so it can be put in the installer config - or be able to ask Accounts for the offline token for that user. Before anything like that can be done, I think we need to put accounts in front of that WAR [1] . What needs to be done here for that? [1] https://github.com/hawkular/hawkular/tree/master/modules/hawkular-wildfly...