Rudder

Spring security allows Basic auth: http://static.springsource.org/spring-security/site/docs/3.0.x/reference/basic.html#basic-processing-filter

For now, we have decide to have a fully NON-AUTHENTICATED REST API, and let Apache manage that part.

It will be really great to have at least a configuration option to force user to be authenticated to use the API.

To sum up:

• the API is available without authentication if configuration property "rudder.rest.allowNonAuthenticatedUser" is true
• the username used as the actor of rest action is:
  • the authenticated user if one is available
  • else the string given in header X-REST-USERNAME
  • else "UnknownRestUser" if none of the above is available.

A simple status REST URL is available at: "/api/status" which send a plaintext answer containing "OK"
Deployment can be trigger with "/api/deploy/start", which sent a plaintext answer containing "OK"

There is only two case:

• either authentication is requested for using the REST API, and in such case the authentication means is decorelated from Rudder (more precisely, its managed by Spring Security and can be anything supported by that framework)
• or no authentication is required, and in such case we assume confidence in the client, and just want to be able to log as much information as we can. Part of that information is who/what the client is, what we can't decide based on an authentication token, and so, as we are in a trusted relationship with the client, we ask "please, add in that header relevant information about yourself".

Hope it make things clearer,