On the configuration page {API name} -> {service name} -> Authorization single methods for the service can be put under authentication:
In this page you can specify which HTTP methods to put under authentication, for your entity and collection service.
E.g.:
If I anderstand this correctly, the checked methods should then require authorization and the other ones not.
I have two services in my application: User and Address. The problem is: Wheter I activate the authorization for one of them or not, or even if the authorization is deactivated for all methods of all services -- from the moment, when I choose the auth type for my API, every request requires authentication and returns the status code 401, if no credentials are sent.
What can be wrong here? How to put only some methods under authentication?
UPDATE
The relevant configs:
/config/autoload/global.php
return array(
...
'zf-mvc-auth' => array(
'authentication' => array(
'map' => array(
'AddressBookAPI\\V1' => 'demo',
),
),
),
);
/config/autoload/local.php
return array(
...
'zf-mvc-auth' => array(
'authentication' => array(
'adapters' => array(
'demo' => array(
'adapter' => 'ZF\\MvcAuth\\Authentication\\HttpAdapter',
'options' => array(
'accept_schemes' => array(
0 => 'basic',
),
'realm' => 'demo',
'htpasswd' => 'data/users.htpasswd',
),
),
),
),
),
);
/module/AddressBookAPI/config/module.config.php
return array(
...
'zf-mvc-auth' => array(
'authorization' => array(
'AddressBookAPI\\V1\\Rest\\User\\Controller' => array(
'collection' => array(
'GET' => false,
'POST' => false,
'PUT' => false,
'PATCH' => false,
'DELETE' => false,
),
'entity' => array(
'GET' => true,
'POST' => false,
'PUT' => false,
'PATCH' => false,
'DELETE' => false,
),
),
'AddressBookAPI\\V1\\Rest\\Address\\Controller' => array(
'collection' => array(
'GET' => false,
'POST' => false,
'PUT' => false,
'PATCH' => false,
'DELETE' => false,
),
'entity' => array(
'GET' => false,
'POST' => false,
'PUT' => false,
'PATCH' => false,
'DELETE' => false,
),
),
),
),
);
