From 7f3340c007bd6bb5f421373b0c7334fc8d5fd8ac Mon Sep 17 00:00:00 2001
From: Shireesh Anjal <shireesh@gluster.com>
Date: Tue, 19 Jul 2011 20:12:36 +0530
Subject: Security configuration to make sure that all REST calls are
 authenticated.

---
 .../storage/management/client/ClustersClient.java  | 28 ----------------------
 .../src/spring/gluster-server-security.xml         | 15 +++++-------
 2 files changed, 6 insertions(+), 37 deletions(-)

(limited to 'src')

diff --git a/src/com.gluster.storage.management.client/src/com/gluster/storage/management/client/ClustersClient.java b/src/com.gluster.storage.management.client/src/com/gluster/storage/management/client/ClustersClient.java
index 31809c75..0185084c 100644
--- a/src/com.gluster.storage.management.client/src/com/gluster/storage/management/client/ClustersClient.java
+++ b/src/com.gluster.storage.management.client/src/com/gluster/storage/management/client/ClustersClient.java
@@ -71,32 +71,4 @@ public class ClustersClient extends AbstractClient {
 	public void deleteCluster(String clusterName) {
 		deleteSubResource(clusterName);
 	}
-	
-	public static void main(String args[]) {
-		UsersClient usersClient = new UsersClient();
-		
-		try {
-			usersClient.authenticate("gluster", "gluster");
-		} catch(Exception e) {
-			e.printStackTrace();
-		}
-		
-		ClustersClient client = new ClustersClient();
-		client.setSecurityToken(usersClient.getSecurityToken());
-		System.out.println(client.getClusterNames());
-		try {
-			client.createCluster("test1");
-		} catch (GlusterRuntimeException e) {
-			System.out.println(e.getMessage());
-		}
-
-		System.out.println(client.getClusterNames());
-
-		try {
-			client.deleteCluster("test1");
-		} catch (GlusterRuntimeException e) {
-			System.out.println(e.getMessage());
-		}
-		System.out.println(client.getClusterNames());
-	}
 }
diff --git a/src/com.gluster.storage.management.server/src/spring/gluster-server-security.xml b/src/com.gluster.storage.management.server/src/spring/gluster-server-security.xml
index 6f3ad72f..abcd8c05 100644
--- a/src/com.gluster.storage.management.server/src/spring/gluster-server-security.xml
+++ b/src/com.gluster.storage.management.server/src/spring/gluster-server-security.xml
@@ -11,16 +11,13 @@
 	">
 
 	<http auto-config="true" use-expressions="true">
-		<!-- intercept-url pattern="/1.0/*"
-			access="hasRole('ROLE_ADMIN') and fullyAuthenticated" />
-		<intercept-url pattern="/*" access="permitAll" /-->
-		
 		<!-- SSL Protection -->
-	<intercept-url pattern="/*" access="hasRole('ROLE_ADMIN') and fullyAuthenticated" requires-channel="https" />
-	<!-- intercept-url pattern="/*" access="permitAll" requires-channel="any" /-->
-	<port-mappings>
-		<port-mapping http="8080" https="8443" />
-	</port-mappings>
+		<intercept-url pattern="/1.0/**" access="hasRole('ROLE_ADMIN') and fullyAuthenticated" requires-channel="https" />
+		<intercept-url pattern="*.jnlp" access="hasRole('ROLE_ADMIN') and fullyAuthenticated" requires-channel="any" />
+		<!-- intercept-url pattern="/*" access="permitAll" requires-channel="any" / -->
+		<port-mappings>
+			<port-mapping http="8080" https="8443" />
+		</port-mappings>
 
 		<!-- HTTP basic authentication -->
 		<http-basic />
-- 
cgit