This does work just to be clear 
<java>
setRestAuthenticator(new RestAuthenticator() {
@Override
public boolean requestRequiresAuthentication(Request request) {
final org.restlet.security.User restletUser = new org.restlet.security.User();
restletUser.setIdentifier("XXX");
final ClientInfo info = new ClientInfo();
info.setUser(restletUser);
request.setClientInfo(info);
return false;
}
@Override
public boolean isRequestAuthorized(Request request) {
return true;
}
});
</java>
<java>
setRestAuthenticator(new RestAuthenticator() {
@Override
public boolean requestRequiresAuthentication(Request request) {
final org.restlet.security.User restletUser = new org.restlet.security.User();
restletUser.setIdentifier("XXX");
final ClientInfo info = new ClientInfo();
info.setUser(restletUser);
request.setClientInfo(info);
return false;
}
@Override
public boolean isRequestAuthorized(Request request) {
return true;
}
});
</java>
IMO the guide should be updated with some of this information. I was attempting to turn off authentication completely and ran into the same issue described about (NPE on user) even though it say authentication isn't required.
For Example this doesn't work:
<java>
public MyActivitiRestServicesApplication() {
super();
setRestAuthenticator(new RestAuthenticator() {
@Override
public boolean requestRequiresAuthentication(Request request) {
return false;
}
@Override
public boolean isRequestAuthorized(Request request) {
return true;
}
});
}
</java>
makes no mention of the need to set a user context. A simple example would be nice too Thanks!
For Example this doesn't work:
<java>
public MyActivitiRestServicesApplication() {
super();
setRestAuthenticator(new RestAuthenticator() {
@Override
public boolean requestRequiresAuthentication(Request request) {
return false;
}
@Override
public boolean isRequestAuthorized(Request request) {
return true;
}
});
}
</java>
"It's possible to remove authentication from certain resources or adding additional authorisation on top of being an authenticated user (eg. being part of group X allows a user to execute request with URL Y). This can be achieved by using an implementation of org.activiti.rest.common.filter.RestAuthenticator which has 2 methods:
boolean requestRequiresAuthentication(Request request): Called before a request is checked for authentication (valid username and password is passed in header). If this method returns true, the method needs authentication. If false is returned, the request will be done regardless of the request being authenticated. If false is returned, isRequestAuthorized will not be called either for this request."
makes no mention of the need to set a user context. A simple example would be nice too
Thanks!
