>From 6d493f7a58b0a68b2a46bafb5b025e868f5dc99e Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Tue, 8 Oct 2013 17:02:50 -0400
Subject: [PATCH] fix auth and authz for Profiles REST API

Ticket 727
---
 base/ca/shared/webapps/ca/WEB-INF/auth.properties              |  4 ++++
 .../src/com/netscape/certsrv/profile/ProfileResource.java      | 10 ++++++----
 .../com/netscape/cms/authorization/AuthMethodInterceptor.java  |  2 +-
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/base/ca/shared/webapps/ca/WEB-INF/auth.properties b/base/ca/shared/webapps/ca/WEB-INF/auth.properties
index 20f3dd864254779f9939c3d2873eb28a9cddf57c..f3f54ae9b22890815caac4041d58770f047dead5 100644
--- a/base/ca/shared/webapps/ca/WEB-INF/auth.properties
+++ b/base/ca/shared/webapps/ca/WEB-INF/auth.properties
@@ -11,4 +11,8 @@ admin.groups = certServer.ca.groups,execute
 admin.kraconnector = certServer.ca.connectorInfo,modify
 agent.certrequests = certServer.ca.certrequests,execute
 agent.certs = certServer.ca.certs,execute
+profile.create = certServer.profile.configuration,modify
+profile.delete = certServer.profile.configuration,modify
+profile.modify = certServer.profile.configuration,modify
+profile.approve = certServer.ca.request.profile,approve
 securityDomain.installToken = certServer.securitydomain.domainxml,read
diff --git a/base/common/src/com/netscape/certsrv/profile/ProfileResource.java b/base/common/src/com/netscape/certsrv/profile/ProfileResource.java
index 5c733aa592ea4896637d9f6496140ee4259232e5..cc7b8153c1276123db2ae3b22d3f30ab3b580741 100644
--- a/base/common/src/com/netscape/certsrv/profile/ProfileResource.java
+++ b/base/common/src/com/netscape/certsrv/profile/ProfileResource.java
@@ -11,9 +11,11 @@ import javax.ws.rs.Produces;
 import javax.ws.rs.QueryParam;
 import javax.ws.rs.core.MediaType;
 
+import com.netscape.certsrv.acls.ACLMapping;
 import com.netscape.certsrv.authentication.AuthMethodMapping;
 
 @Path("profiles")
+@AuthMethodMapping("profiles")
 public interface ProfileResource {
 
     @GET
@@ -26,27 +28,27 @@ public interface ProfileResource {
     public ProfileData retrieveProfile(@PathParam("id") String id);
 
     @POST
-    @AuthMethodMapping("admin")
+    @ACLMapping("profile.create")
     @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
     @Consumes({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
     public void createProfile(ProfileData data);
 
     @POST
     @Path("{id}")
-    @AuthMethodMapping("agent")
+    @ACLMapping("profile.approve")
     @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
     public void modifyProfileState(@PathParam("id") String id, @QueryParam("action") String action);
 
     @PUT
     @Path("{id}")
-    @AuthMethodMapping("admin")
+    @ACLMapping("profile.modify")
     @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
     @Consumes({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
     public void modifyProfile(@PathParam("id") String id, ProfileData data);
 
     @DELETE
     @Path("{id}")
-    @AuthMethodMapping("admin")
+    @ACLMapping("profile.delete")
     @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
     public void deleteProfile(@PathParam("id") String id);
 
diff --git a/base/common/src/com/netscape/cms/authorization/AuthMethodInterceptor.java b/base/common/src/com/netscape/cms/authorization/AuthMethodInterceptor.java
index 257e0ae814e08e4a4114019498f1186de7203174..3f47d0c57a1b8622877de75c857ffe1939e6c1e3 100644
--- a/base/common/src/com/netscape/cms/authorization/AuthMethodInterceptor.java
+++ b/base/common/src/com/netscape/cms/authorization/AuthMethodInterceptor.java
@@ -70,8 +70,8 @@ public class AuthMethodInterceptor implements ContainerRequestFilter {
             authProperties.put("account", "certUserDBAuthMgr,passwdUserDBAuthMgr");
             authProperties.put("admin", "certUserDBAuthMgr");
             authProperties.put("agent", "certUserDBAuthMgr");
+            authProperties.put("profiles", "certUserDBAuthMgr");
             authProperties.put("securityDomain.installToken", "passwdUserDBAuthMgr");
-
         } else {
             authProperties.load(url.openStream());
         }
-- 
1.8.3.1

