How to secure Rest Services from Ivy 6.2 with Authorization Bearer instead of Basic

Question

As the tittle. I'm using Ivy version 6.2 and would like to know how to secure my REST Services using Bearer Authorization instead of basic. Thanks

Accepted Answer

You are free to use any authentication method on modern Axon.ivy platforms.

If you need a non standard authorization approach just implement a custom tomcat valve for authentication and authorization: https://developer.axonivy.com/doc/latest/EngineGuideHtml/integration.html#integration-waf-sso

Implementation details can be found here: https://developer.axonivy.com/doc/latest/EngineGuideHtml/configuration.html#configuration-tomcat-context-xml or here https://github.com/ivy-samples/tomcatValve

... so far about modern Platforms. But I'm not sure whether this works on the very outdated 6.2 leading edge version. So I suggest that you basically ensure that it works on 7.0 LTS. And may give it a try afterwards in the old 6.2... Keep in mind: it was never the idea that outdated leading edge versions are used productive for a long time. Update as fast as you can if you want to operate a secure engine with well documented supported featureset.

Answer 2

Thanks for your instructions. I created a custom valve in Ivy 7.1 to validate the bearer token. Inside the method, I get the Authorization token in the header and check if it is valid or not, if not, could I stop the request and throw an unauthorized exception back to the client?

@Override
public void invoke(Request request, Response response) throws IOException, ServletException {

    String token = request.getHeader("Authorization");

    if(StringUtils.isEmpty(token)){
        getNext().invoke(request, response);
        return;
    }
    if(TokenValidator.isValidToken(token)){
        String userName = extractUserNameFromToken(token);
        request.setUserPrincipal(createUserPrincipal(userName));
        getNext().invoke(request, response);
    } else {
        // How to reject the request and throw unauthorized exception back to the client? 
    }
}

Thanks

How to secure Rest Services from Ivy 6.2 with Authorization Bearer instead of Basic

Follow this question

Related questions