具有拦截URL的Mule HTTP基本身份验证

Question

I want to implement HTTP Basic Authentication for my mule application which listens on HTTP and the URI is http://localhost:8082/api/customers . Lets suppose only POST and GET are supported.

I tried to implement authentication in such a way that

• If a user has ROLE_ADMIN role he can access both POST and GET endpoints
• If a user has only ROLE_USER role he can access only GET endpoint

I wanted to leverage Spring authentication manager for this purpose. I configured the authentication as below:

First I created authentication manager

<ss:authentication-manager xmlns:ss="http://www.springframework.org/schema/security" alias="authenticationManager">
    <ss:authentication-provider>
        <ss:user-service id="userService">
            <ss:user name="user" password="user" authorities="ROLE_USER" />
            <ss:user name="admin" password="admin" authorities="ROLE_ADMIN" />
        </ss:user-service>
    </ss:authentication-provider>
</ss:authentication-manager>

Then I thought of intercepting the url

<ss:http auto-config="true" realm="mule-realm" use-expressions="true">
    <ss:intercept-url pattern="/api/customers" method="GET"  access="ROLE_USER"/>
    <ss:intercept-url pattern="/api/customers" method="POST" access="ROLE_ADMIN"/>
</ss:http>

Finally I placed basic-security-filter after HTTP Listener like below

<http:listener config-ref="CustomerAPI-httpListenerConfig" path="/api/*" doc:name="HTTP" />
<http:basic-security-filter realm="mule-realm" securityProviders="memory-provider" />

<mule-ss:security-manager xmlns:mule-ss="http://www.mulesoft.org/schema/mule/spring-security" name="muleSecurityManager">
    <mule-ss:delegate-security-provider name="memory-provider" delegate-ref="authenticationManager" />
</mule-ss:security-manager>

Now, what I expected is, a request from a user whose role is ROLE_USER (with user/user credentials) can only access GET and a request from a user whose role is ROLE_ADMIN (with admin/admin credentials) can access both GET and POST.

But I was wrong. A request from a user whose role is ROLE_USER accesses both POST and GET which is what I never expected.

Can anyone please guide me in the right way to achieve the above requirement?

Answer 1

You can see this example raml-intro to setup your api with spring-security. In this case, I am using the security.properties to manage users and roles.

As you can see in the those lines I have a flow which handle security access but there are no restriction by roles.

In order to handle roles you can modify the code and add the following line

<mule-ss:authorization-filter requiredAuthorities="ROLE_ADMIN"/>

Your flow should look like this:

<flow name="get:/publishers:publishers-config">
    <mule-ss:http-security-filter realm="mule-realm"
        securityProviders="security-provider"/>
    <mule-ss:authorization-filter requiredAuthorities="ROLE_ADMIN"/>
    <set-payload
        value="[{&#xA;  &quot;id&quot; : 1,&#xA;  &quot;name&quot; : &quot;DC Comics&quot;&#xA;},&#xA;{&#xA;  &quot;id&quot; : 2,&#xA;  &quot;name&quot; : &quot;Marvel Comics&quot;&#xA;}]"
        doc:name="Set Payload" />
</flow>

Answer 2

If you want to implement the authorization based on the Htttp Method, you can use the next example:

<ss:authentication-manager xmlns:ss="http://www.springframework.org/schema/security" alias="authenticationManager">
    <ss:authentication-provider>
        <ss:user-service id="userService">
            <ss:user name="user" password="user" authorities="ROLE_USER" />
            <ss:user name="admin" password="admin" authorities="ROLE_ADMIN,ROLE_USER" />
        </ss:user-service>
    </ss:authentication-provider>
</ss:authentication-manager>

{...}

<flow name="testingFlow">
    <http:listener config-ref="HTTP_Listener_Configuration2" path="/*" doc:name="HTTP" allowedMethods="GET,POST"/>

    <http:basic-security-filter realm="mule-realm"/>
    <set-variable variableName="method" value="#[header:INBOUND:http.method]" doc:name="method rest" />

    <choice>
        <when expression="method.equals('GET')">
            <mule-ss:authorization-filter requiredAuthorities="ROLE_USER"/>
        </when>
        <when expression="method.equals('POST')">
            <mule-ss:authorization-filter requiredAuthorities="ROLE_ADMIN"/>
        </when>
    </choice>       
</flow>

Note that it's necessary to assign the roles ROLE_ADMIN and ROLE_USER to the user admin because "mule-ss:authorization-filter" doesn't allow multi values.