Possible bug Activiti-rest 5.15

[yahekia]

I have created a CustomRestAuthenticator because for the moment I do not want authentication.

package activiti.extension.rest;

import org.activiti.rest.common.filter.RestAuthenticator;
import org.restlet.Request;

public class CustomRestAuthenticator implements RestAuthenticator {

   public boolean requestRequiresAuthentication(Request request) {
       return false;
    }

   public boolean isRequestAuthorized(Request request) {
       return false;
    }

}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

public class NoAuthenticationActivitiRestServicesApplication extends ActivitiRestServicesApplication {
   public NoAuthenticationActivitiRestServicesApplication() {
      super();
      this.setRestAuthenticator(new CustomRestAuthenticator());
   }

   @Override
   public String authenticate(Request request, Response response) {
      if (!request.getClientInfo().isAuthenticated()) {
         authenticator.challenge(response, false);
         return null;
      }
      return "KERMIT!";
   }
}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

If I do not override the method authenticate throws a nullpointerexception.

[trademak]

In ActivitiRestServicesApplication there's an invocation of initializeAuthentication();
Did you override that? Otherwise authenticate will still be called.

Best regards,

[yahekia]

Hello Tijs,

no, I do not override that. I follow the instructions in the user guide (http://www.activiti.org/userguide/#N12F8B).

boolean requestRequiresAuthentication(Request request): Called before a request is checked for authentication (valid username and password is passed in header). If this method returns true, the method needs authentication. If false is returned, the request will be done regardless of the request being authenticated. If false is returned, isRequestAuthorized will not be called either for this request.


I supossed that if I set it always to false, there was no need to be authenticated. So, is it wrong the user guide?

[jbarrez]

Indeed, looking at the source code it seems the initializeAuthentication also must be overriden.