[infinispan-issues] [JBoss JIRA] (ISPN-8736) REST endpoint authorization

[Tristan Tarrant (JIRA)]

     [ https://issues.jboss.org/browse/ISPN-8736?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Tristan Tarrant updated ISPN-8736:
----------------------------------
    Description: 
The REST endpoint does not use the authenticated user to access authz caches. We need to:
- integrate with the ServerAuthenticationProvider as used by the Hot Rod endpoint so that we can use security callbacks and retrieve a fully populated subject (including groups)
- add SecurityActions within the rest code
- Return 403 forbidden where needed

  was:
The REST endpoint does not apply authorization checks. We need to:
- integrate with the ServerAuthenticationProvider as used by the Hot Rod endpoint so that we can use security callbacks and retrieve a fully populated subject (including groups)
- add SecurityActions within the rest code
- Return 403 forbidden where needed



> REST endpoint authorization
> ---------------------------
>
>                 Key: ISPN-8736
>                 URL: https://issues.jboss.org/browse/ISPN-8736
>             Project: Infinispan
>          Issue Type: Enhancement
>          Components: REST, Security, Server
>            Reporter: Tristan Tarrant
>            Assignee: Tristan Tarrant
>
> The REST endpoint does not use the authenticated user to access authz caches. We need to:
> - integrate with the ServerAuthenticationProvider as used by the Hot Rod endpoint so that we can use security callbacks and retrieve a fully populated subject (including groups)
> - add SecurityActions within the rest code
> - Return 403 forbidden where needed



--
This message was sent by Atlassian JIRA
(v7.5.0#75005)