Restlet 2.0.8: Multiple authentication methods (BASIC, DIGEST) for single restlet Application instance?

Question

We're using Restlet 2.0.8 and have an Application instance overwriting org.restlet.Application#createInboundRoot(). In there, we create the Router instance and return (at the moment) a DigestAuthenticator, like in the code snipped below:

@Override
public synchronized Restlet createInboundRoot() {
    log.info("App::createInboundRoot called");

    this.authenticator = getAuthenticator();

    Router router = new Router(getContext());
    router.attach("/echo", EchoResource.class);
    router.attach("/status", StatusResource.class);

    authenticator.setNext(router);
    return authenticator;
}

private ChallengeAuthenticator getAuthenticator() {
    DigestAuthenticator auth = new DigestAuthenticator(getContext(), "Guard", "s3cret");
    auth.setWrappedVerifier(new SimpleVerifier("user","pass");
    auth.setOptional(false);
    return auth;
}

What I would like to achieve is:

have the EchoResource using digest authentication and the StatusResource should use HTTP basic authentication

Is this possible with Restlets?

Best, Chris

score 1 · Accepted Answer · answered Jul 29 '11 at 09:19

1

This is possible by chaining the DigestAuthenticator (optional: true) and the BasicAuthenticator (optional: false). Pseudo-code:

   digestAuth.setNext(basicAuth);
   basicAuth.setNext(router);

answered Jul 29 '11 at 09:19

Jerome Louvel

2,882
18
19

Correct me if I'm wrong but that means that both /echo and /status are at least protected by basic auth right? – Christof Aug 01 '11 at 03:18
What we wanted is have the Echo only be protected by Digest and Status by basic auth. What we've done is introduce a 'forking' router and attach the digest- and basicAuth routers to different paths, like so (Pseudo-code): forkingRouter.attach("/status", basicAuth, Template.MODE_STARTS_WITH); forkingRouter.attach("/echo", digestAuth, Template.MODE_STARTS_WITH); – Christof Aug 01 '11 at 03:45

score 0 · Answer 2 · answered Nov 30 '12 at 14:21

0

In a similar situation, we created two org.restlet.Application objects, require authentication for one Application as in the question above, and did attach both the Applications to different paths in the Servlet container.

answered Nov 30 '12 at 14:21

mringwal

476
3
10

Restlet 2.0.8: Multiple authentication methods (BASIC, DIGEST) for single restlet Application instance?

2 Answers2