0

When having WebSphere Liberty Profile (8.5.5.6) handle authentication via basic auth and security constraints, is there any way to modify or intercept the 401 response going back to the caller? We need to add CORS headers to the response, and would prefer to still let WLP handle authentication, if possible.

Westy
  • 707
  • 2
  • 10
  • 23

1 Answers1

1

Liberty profile has had built in CORS support since the January beta. It hasn't GAed on a supported fix pack yet, but it is coming soon.

If you can move up to a newer fix pack you can use the bells-1.0 feature to attach a ServletFilter to web applications, this ServletFilter can then attach CORS data. I answered a question that just adds a TEST header, but it wouldn't be hard to change it to be the CORS one.

If you can't move up to a newer fix pack then you can take the same filter from above and put the jar in your web apps WEB-INF/lib.

Community
  • 1
  • 1
Alasdair
  • 3,071
  • 15
  • 20
  • Thanks, Alasdair. I looked at your link to the other question you answered. I can't move up to the beta, so I'm trying to do this in the war file. However, it doesn't look like the SCI is being called. Is it acceptable to have that SCI class in the WEB-INF/classes subdirectory, or does it need to be in a jar in the WEB-INF/lib subdirectory? – Westy Feb 23 '16 at 00:46
  • I answered my own question - I have the SCI class in both 'classes/', and in a jar in 'lib/'. It made no difference. I also have the services file in both '/META-INF/services' and '/WEB-INF/classes/META-INF/services'. cat 'ServletContainerInitializer' `com.ibm.youribm.services.cms.rest.CmsServletContainerInitializer` – Westy Feb 23 '16 at 01:03
  • And here's my class (the system.out is never being displayed): `public class CmsServletContainerInitializer implements ServletContainerInitializer { @Override public void onStartup(Set> arg0, ServletContext arg1) throws ServletException { System.out.println("WESTY DIAG - CmsServletContainerInitializer.onStartup"); arg1.addFilter("CmsServletFilter", CmsServletFilter.class).addMappingForUrlPatterns(null, false, "/*"); }` – Westy Feb 23 '16 at 01:04
  • Is your file called ServletContainerInitilizer? If so rename it to javax.servlet.ServletContainerInitializer it should be on the app classpath so WEB-INF/classes/META-INF should work. – Alasdair Feb 25 '16 at 00:53
  • Thanks again, Alasdair. But that made no difference, it's still never being called. – Westy Feb 26 '16 at 16:37