[ https://issues.jboss.org/browse/ISPN-8736?page=com.atlassian.jira.plugin.... ] Tristan Tarrant updated ISPN-8736: ---------------------------------- Description: The REST endpoint does not use the authenticated user to access authz caches. We need to: - integrate with the ServerAuthenticationProvider as used by the Hot Rod endpoint so that we can use security callbacks and retrieve a fully populated subject (including groups) - add SecurityActions within the rest code - Return 403 forbidden where needed was: The REST endpoint does not apply authorization checks. We need to: - integrate with the ServerAuthenticationProvider as used by the Hot Rod endpoint so that we can use security callbacks and retrieve a fully populated subject (including groups) - add SecurityActions within the rest code - Return 403 forbidden where needed -- This message was sent by Atlassian JIRA (v7.5.0#75005)