Answer by thminh

thminh — Thu, 28 Jun 2018 02:55:25 -0400

Thanks for your instructions. I created a custom valve in Ivy 7.1 to validate the bearer token. Inside the method, I get the Authorization token in the header and check if it is valid or not, if not, could I stop the request and throw an unauthorized exception back to the client?

@Override
public void invoke(Request request, Response response) throws IOException, ServletException {

    String token = request.getHeader("Authorization");

    if(StringUtils.isEmpty(token)){
        getNext().invoke(request, response);
        return;
    }
    if(TokenValidator.isValidToken(token)){
        String userName = extractUserNameFromToken(token);
        request.setUserPrincipal(createUserPrincipal(userName));
        getNext().invoke(request, response);
    } else {
        // How to reject the request and throw unauthorized exception back to the client? 
    }
}

Thanks

Answer by Reguel Wermelinger

Reguel Wermelinger — Fri, 22 Jun 2018 02:25:22 -0400

You are free to use any authentication method on modern Axon.ivy platforms.

If you need a non standard authorization approach just implement a custom tomcat valve for authentication and authorization: https://developer.axonivy.com/doc/latest/EngineGuideHtml/integration.html#integration-waf-sso

Implementation details can be found here: https://developer.axonivy.com/doc/latest/EngineGuideHtml/configuration.html#configuration-tomcat-context-xml or here https://github.com/ivy-samples/tomcatValve

... so far about modern Platforms. But I'm not sure whether this works on the very outdated 6.2 leading edge version. So I suggest that you basically ensure that it works on 7.0 LTS. And may give it a try afterwards in the old 6.2... Keep in mind: it was never the idea that outdated leading edge versions are used productive for a long time. Update as fast as you can if you want to operate a secure engine with well documented supported featureset.

Answers to: How to secure Rest Services from Ivy 6.2 with Authorization Bearer instead of Basic

Answer by thminh

Answer by Reguel Wermelinger