Ticket #233 (closed defect: fixed)

Opened 4 years ago

Last modified 3 years ago

Security: Authentication gets lost when using representation builder

Reported by: jgou Owned by: jgou
Priority: critical Milestone: 0.4
Component: modules/kauri-security Version: trunk
Keywords: Cc:

Description

When using kauri security and the kauri representation builder, the Authentication object is no longer available when the template representation is created.
This is because the SecurityContextHolder.clearContext() method in SecurityFilter is called after returning the KauriRepresentation but before creating the TemplateRepresentation.
This means we can't use security features (t:protect) in the templates in this scenario.

Howto-test in kauri-security-sample:

add a method in RoleSensitiveJaxRsResource

@GET
@Path("representation")
public KauriRepresentation getRepresentation() {
  return new KauriRepresentation("representation", new HashMap<String, Object>());
}

add a file "representation.xml" in the templates folder

<?xml version="1.0"?>
<html t:inherit="module:/templates/layout/layout.xml"
      xmlns:t="http://kauriproject.org/template">
  <t:block name="main">
    <p>This template is called by the representation builder.</p>
    <p>Below is a fragent only visible to a "user".</p>
    <t:protect access="ROLE_USER">
      <p>This is only visible to ROLE_USER.</p>
    </t:protect> 
  </t:block>
</html>

and navigate to ​http://localhost:8888/roleSensitiveJaxRsResource/representation .
This will result in an error : org.kauriproject.template.TemplateException: protect instruction is used but no AccessDecider is provided.

Note: the following issue might be related in case this triggers thinking about storing the securitycontext: #181

Change History

comment:1 Changed 3 years ago by mpo

First TODO is checking how this is different then the 'securepage' sample page
​http://localhost:8888/securepage.html

comment:2 Changed 3 years ago by jgou

  • Priority changed from major to critical

comment:3 Changed 3 years ago by jgou

  • Owner changed from bruno to jgou
  • Status changed from new to accepted

comment:4 Changed 3 years ago by jgou

  • Status changed from accepted to closed
  • Resolution set to fixed

(In [1544]) Ensure that the RepresentationFilter? is also executed (when representations are active) before the SecurityFilter? clears the SecurityContext?.
This fixes #233 . Thanks Bruno for the valuable feedback.

Note: See TracTickets for help on using tickets.