My application (my-app.war) has a JAX-RS endpoint, secured with a given role, like this:
Endpoint.java
@Path("endpoint/")
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@DeclareRoles({"ADMIN_ROLE"})
public class Endpoint {
@POST
@RolesAllowed({"ADMIN_ROLE"})
public void post() {
}
}
server.xml
<server>
<featureManager>
<feature>jaxrs-2.1</feature>
<feature>appSecurity-3.0</feature>
</featureManager>
<application id="my-app" context-root="/" location="my-app.war" type="war">
</application>
<variable name="default.http.port" defaultValue="9080"/>
<variable name="default.https.port" defaultValue="9443"/>
<httpEndpoint id="defaultHttpEndpoint" httpPort="${default.http.port}" httpsPort="${default.https.port}"/>
<basicRegistry realm="defaultRealm">
<user name="test-user" password="test-password"/>
<group name="ADMIN_GROUP">
<member name="test-user"/>
</group>
</basicRegistry>
</server>
Now I have to bind ADMIN_GROUP to ADMIN_ROLE.
If I do it on server.xml application, then everything works fine:
<application id="my-app" context-root="/" location="my-app.war" type="war">
<application-bnd>
<security-role name="ADMIN_ROLE">
<group name="ADMIN_GROUP" />
</security-role>
</application-bnd>
</application>
The application is deployed and upon invoking the endpoint without authentication, it returns 403 (authentication required). When supplied with authentication header, it returns 204 (no content) as intended.
Now the problem lies when I try to configure the binding in ibm-application-bnd.xml:
<?xml version="1.0" encoding="UTF-8"?>
<application-bnd xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://websphere.ibm.com/xml/ns/javaee http://websphere.ibm.com/xml/ns/javaee/ibm-application-bnd_1_2.xsd"
xmlns="http://websphere.ibm.com/xml/ns/javaee"
version="1.2">
<
<security-role name="ADMIN_ROLE">
<group name="ADMIN_GROUP" />
</security-role>
</application-bnd>
I've put it both in META-INF/ibm-application-bnd.xml and WEB-INF/ibm-application-bnd.xml. But both of them are completely ignored (I've even went as far as adding invalid xml there, but get no error message from OpenLiberty).
Every call to the endpoint returns 403, even when supplied with authentication.
In https://www.ibm.com/docs/en/was-liberty/base?topic=liberty-configuring-authorization-applications-in, it says [emphasis added]:
Configure the authorization information such as the user and group to role mapping. You can configure the authorization table in the following ways:
If you have an EAR file, you can add the authorization configuration definition to the ibm-application-bnd.xml or ibm-application-bnd.xmi file.
If you have standalone WAR files, you can add the authorization table definitions to the server.xml file under the respective application element. You can use the WebSphere® Application Server Developer Tools for Eclipse to do this.
Does this mean that for war applications the binding MUST BE on server.xml?
