This is an automated email from the ASF dual-hosted git repository. tbouron pushed a change to branch master in repository https://gitbox.apache.org/repos/asf/brooklyn-server.git.
from 4f7a122 This closes #1034 new 4f24a93 share sessions among all BrooklynSecurityProviderFilter-using bundles new c21bdc8 fix security provider delegation new b1d1b11 make /logout just log out new c30d4c9 Merge branch 'make-logout-just-logout' into misc8 new 39cd453 simplify logout api new bb9a38f reinstall shared session handler if it has stopped new cb576a8 CSRF should return "forbidden" not "unauthorized" as we don't need authorization, we need the client to correctly encode the CSRF header. new 7cbf124 lots of debugging for case where session invalidation hangs on logout new b356e52 tidy, removing debug code, just having a clean-ish solution new 1518c1c make double-check/initialized field volatile new 6417a79 reinstall shared session handler if it has stopped new 3be6eac make double-check/initialized field volatile new c4e245b Merge branch 'fix-sessions-4' into make-logout-just-logout new 11d6f14 fix test for csrf mismatch now returns forbidden new 1a15c36 use adapter to access a shared session when required new 1d6f63a don't create new session until request is authorized, change SecurityProvider API new f6df273 better error-handling for bad auth strings new dc30572 comments addressing PR questions new f54c1e2 Merge pull request #1032 from ahgittin/make-logout-just-logout The 12325 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: karaf/jetty-config/src/main/resources/jetty.xml | 43 -- parent/pom.xml | 5 + .../org/apache/brooklyn/rest/api/LogoutApi.java | 26 +- rest/rest-resources/pom.xml | 8 +- .../BrooklynSecurityProviderFilterHelper.java | 96 ++--- .../brooklyn/rest/filter/CsrfTokenFilter.java | 33 +- .../rest/filter/EntitlementContextFilter.java | 4 +- .../brooklyn/rest/resources/LogoutResource.java | 105 +++-- .../brooklyn/rest/resources/ScriptResource.java | 19 +- .../brooklyn/rest/resources/ServerResource.java | 9 +- .../provider/AbstractSecurityProvider.java | 5 +- .../security/provider/AnyoneSecurityProvider.java | 5 +- .../provider/BlackholeSecurityProvider.java | 5 +- ...klynUserWithRandomPasswordSecurityProvider.java | 21 +- .../provider/DelegatingSecurityProvider.java | 38 +- .../provider/ExplicitUsersSecurityProvider.java | 15 +- .../security/provider/LdapSecurityProvider.java | 23 +- .../rest/security/provider/SecurityProvider.java | 38 +- .../rest/util/MultiSessionAttributeAdapter.java | 477 +++++++++++++++++++++ .../main/resources/OSGI-INF/blueprint/service.xml | 6 +- .../brooklyn/rest/CsrfTokenFilterLauncherTest.java | 4 +- .../AuthenticateAnyoneSecurityProvider.java | 5 +- .../security/provider/TestSecurityProvider.java | 7 +- 23 files changed, 777 insertions(+), 220 deletions(-) create mode 100644 rest/rest-resources/src/main/java/org/apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java