web-resource-collection without authorization

[LucasPenido]

I am implementing a new module under the /manager/api folder that would expose an endpoint without need of authorization. I've tried to add this endpoint in the web.xml file without a auth-constraint like this:

But I didn't succeed.

There is a way that I could accomplish this?

[msavy]

Are you trying to add an extra JAX-RS resource to the Manager API?

If you check out the 3.x branch you might get some inspiration on how to achieve this.

For example: https://github.com/apiman/apiman/blob/3.x/manager/api/war/tomcat8/src/main/webapp/WEB-INF/web.xml#L104-L184

I think if you simply don't provide a constraint it should not be protected 🤔. It's part of the Java EE specification (aka Jakarta EE), so you should be able to follow that standard.

[msavy]

Check out https://docs.oracle.com/cd/E19798-01/821-1841/bncbk/index.html -- 'Specifying an Authorization Constraint'

[LucasPenido]

@msavy thanks for your reply!
But I am already not providing the auth-constraint. I inserted this web-resource-collection like in the image above but when I make a request to http://localhost:8080/apiman/swaggers/ it says "RESTEASY003210: Could not find resource for full path" and when I insert the web-resource-collection together with others endpoints it says "Unauthorized".

There is a way to create a role that doesn't need authorization?

[msavy]

Sounds more like your extra JAX-RS resource/service isn't being picked up. You likely need to register it. Check out https://github.com/apiman/apiman/blob/master/manager/api/rest-impl/src/main/java/io/apiman/manager/api/rest/impl/ApiManagerApplication.java#L60-L70

[LucasPenido]

@msavy
It worked as expected!
In the web.xml file I inserted the web-resource-collection inside the security-constraint without an auth-constraint then in the ApiManagerApplication.java I registered the JAX-RS that I've created.
It allowed me to make a request without an authorization token!
Thanks very much!

[msavy]

Thanks for letting me know it worked. Good luck!