Pass token on listMethods to enable allowUnauthenticated=false

(SHINDIG-1799)

On the RPC request for method=system.listMethods, no security token is currently
passed.   If shindig.allowUnauthenticated=false, then the listMethods request
fails and shindig fails to start successfully.

[rbaxter85, 2012-06-13 13:40:57]

On 2012/06/13 12:49:11, btlillie wrote:

LGTM.  Out of curiosity, are there no unit tests for this code?

Brian could you add the dev list as well?

[btlillie, 2012-06-13 14:03:57]

On 2012/06/13 13:40:57, rbaxter85 wrote:
> On 2012/06/13 12:49:11, btlillie wrote:
> 
> LGTM.  Out of curiosity, are there no unit tests for this code?
> 
> Brian could you add the dev list as well?

There was nothing that specifically tests whether a token was present or not, or
was added.  Without a constructor change, the existing tests did not require
updates.

There are no tests specifically for allowUnauthenticated=false, especially in
conjunction with the system.listMethods requests.

[btlillie, 2012-06-13 17:50:16]

Updated patch to use Anonymous Security Token

[Stanton, 2012-06-13 17:53:22]

LGTM

[rbaxter85, 2012-06-13 21:06:59]

On 2012/06/13 17:53:22, Stanton wrote:
> LGTM

Brian do you have a link to the JIRA?

[henry.saputra, 2012-06-13 21:16:26]

+1

[rbaxter85, 2012-06-14 13:33:21]

On 2012/06/13 21:16:26, henry.saputra wrote:
> +1

Committed revision 1350234

[btlillie, 2012-06-14 19:11:14]

Switching back to BlobCrypterSecurityToken from AnonymousSecurityToken

[rbaxter85, 2012-06-14 23:12:01]

On 2012/06/14 19:11:14, btlillie wrote:
> Switching back to BlobCrypterSecurityToken from AnonymousSecurityToken

LGTM, but then again I said that last time too :)

[Stanton, 2012-06-15 02:20:46]

LGTM.  As a followup to this review I may look into how we can better generate
SecurityToken token objects that align with the injected codec.  More to come on
that later.

[DouglasLDavies, 2012-06-15 04:17:43]

http://codereview.appspot.com/6306074/diff/7002/java/gadgets/src/main/java/or...
File
java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java
(right):

http://codereview.appspot.com/6306074/diff/7002/java/gadgets/src/main/java/or...
java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java:154:
StringBuilder sb = new StringBuilder( 250 );
So even if secure is set to false you want to pass an encrypted token?

[DouglasLDavies, 2012-06-15 04:21:06]

http://codereview.appspot.com/6306074/diff/7002/java/gadgets/src/main/java/or...
File
java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java
(right):

http://codereview.appspot.com/6306074/diff/7002/java/gadgets/src/main/java/or...
java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java:154:
StringBuilder sb = new StringBuilder( 250 );
On 2012/06/15 04:17:43, DouglasLDavies wrote:
> So even if secure is set to false you want to pass an encrypted token? 

Oh. Never mind. In that case the codec will be basic. Got it.

[rbaxter85, 2012-06-15 13:55:59]

On 2012/06/15 04:21:06, DouglasLDavies wrote:
>
http://codereview.appspot.com/6306074/diff/7002/java/gadgets/src/main/java/or...
> File
>
java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java
> (right):
> 
>
http://codereview.appspot.com/6306074/diff/7002/java/gadgets/src/main/java/or...
>
java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java:154:
> StringBuilder sb = new StringBuilder( 250 );
> On 2012/06/15 04:17:43, DouglasLDavies wrote:
> > So even if secure is set to false you want to pass an encrypted token? 
> 
> Oh. Never mind. In that case the codec will be basic. Got it.

Doug did you actually try out the patch?

[DouglasLDavies, 2012-06-15 15:23:06]

Ya, trying it now on shindig trunk.  Test are failing for me with
org.apache.shindig.auth.SecurityTokenException: Invalid security token
canonical:john.doe:test:domain:appUrl:1:default:1339777341

[DouglasLDavies, 2012-06-15 15:23:06]

Ya, trying it now on shindig trunk.  Test are failing for me with
org.apache.shindig.auth.SecurityTokenException: Invalid security token
canonical:john.doe:test:domain:appUrl:1:default:1339777341

[rbaxter85, 2012-06-15 15:48:16]

On 2012/06/15 15:23:06, DouglasLDavies wrote:
> Ya, trying it now on shindig trunk.  Test are failing for me with
> org.apache.shindig.auth.SecurityTokenException: Invalid security token
> canonical:john.doe:test:domain:appUrl:1:default:1339777341

Doug I am not seeing any failures after apply the patch, are these your own
tests?

[daviesd_oclc.org, 2012-06-15 16:35:50]

I am still having issues.

I rebuilt everything with secure tokens enabled, but skipped tests so that
the build would complete.  Now the listMethods call succeeds, but then the
metadata call fails with org.apache.shindig.auth.SecurityTokenException:
Invalid security token john.doe:john.doe:appid:cont:url:0:default.

This is with the 2 file patch you sent and shindig.properties
allowUnauthenticated=false and secure tokens set in container.js. I am
hitting the commoncontainer and trying to render horoscope.

I'm off for the rest of the day.  I'll check back on things on Monday.

Doug

[Stanton, 2012-06-15 22:30:42]

http://codereview.appspot.com/6306074/diff/7002/java/gadgets/src/main/java/or...
File
java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java
(right):

http://codereview.appspot.com/6306074/diff/7002/java/gadgets/src/main/java/or...
java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java:161:
SecurityToken token = new BlobCrypterSecurityToken("default", "*", "0", parms);
Per Doug D's comments on the dev list, you should use the container parameter
instead of "default"