Spring Basic Authorization for REST service on Liferay not working

Question

I am facing a really awkward problem by implementing Spring Basic Authorization for a rest service in liferay. Actually, the configuration works perfectly when I test the application on my local computer.

The problem appears as soon as I deploy the application on our test server. The server always returns a 401 unauthorized access,but the authorization provider is never reached.

By debugging, I noticed that the request does not contains the header with the credentials (header = null) when reaching the BasicAuthenticationFilter:

if(header != null && header.startsWith("Basic "))

By analyzing the network traffic at the browser, the Authorization header is there.

Here is my security configuration:

 <http pattern="/*" security="none"/>

<!-- urls that need authentication and roles  -->
<http use-expressions="true" >
    <intercept-url pattern="/myrest/url/**" access="hasAnyRole('myrole')" />
    <http-basic/>
</http>

<!-- AuthenticationManager / Provider that checks the authentication against Liferay -->
<beans:bean id="myCustomAuthorizationProvider"
            class="myCustomAuthorizationProvider">
    <beans:constructor-arg ref="myUsersDao"/>
    <beans:constructor-arg ref="MyRolesDao"/>
</beans:bean>

<authentication-manager>
    <authentication-provider ref="myCustomAuthorizationProvider"/>
</authentication-manager>

I will appreciate any help about it.

Rajesh Rajesh · Accepted Answer · 2017-11-11T07:55:33

You need to check if there's any intermediate apache or webserver inbetween that filtering http header before it comes to liferay tomcat. In apache webserver or nginx you need to set authorization header forwarding.

Apache Config

proxy_pass_header Authorization;

For nginx

proxy_set_header X-Forwarded-User $http_authorization;
proxy_set_header X-Real-IP  $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass_header Accept;
proxy_pass_header Server;
proxy_http_version 1.1;
proxy_set_header Authorization $http_authorization;
#proxy_pass_header Authorization;
proxy_set_header ns_server-ui yes;

Spring Basic Authorization for REST service on Liferay not working

1 Answers