[infinispan-issues] [JBoss JIRA] (ISPN-8736) REST endpoint authorization

[Tristan Tarrant (Jira)]

     [ https://issues.jboss.org/browse/ISPN-8736?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Tristan Tarrant updated ISPN-8736:
----------------------------------
              Status: Pull Request Sent  (was: Open)
    Git Pull Request: https://github.com/infinispan/infinispan/pull/7109


> REST endpoint authorization
> ---------------------------
>
>                 Key: ISPN-8736
>                 URL: https://issues.jboss.org/browse/ISPN-8736
>             Project: Infinispan
>          Issue Type: Enhancement
>          Components: REST, Security, Server
>            Reporter: Tristan Tarrant
>            Assignee: Tristan Tarrant
>            Priority: Major
>
> The REST endpoint does not use the authenticated user to access authz caches. We need to:
> - integrate with the ServerAuthenticationProvider as used by the Hot Rod endpoint so that we can use security callbacks and retrieve a fully populated subject (including groups). This should ultimately connect with Elytron.
> - add SecurityActions within the rest code
> - Return 403 forbidden where needed



--
This message was sent by Atlassian Jira
(v7.12.1#712002)