Package ch.tocco.nice2.web.core.impl.servlet.req

Class CheckRequiredRolesServlet

java.lang.Object
jakarta.servlet.GenericServlet
jakarta.servlet.http.HttpServlet
ch.tocco.nice2.web.core.api.auth.SecureServlet
ch.tocco.nice2.web.core.impl.servlet.req.AbstractJsonServlet
ch.tocco.nice2.web.core.impl.servlet.req.CheckRequiredRolesServlet
All Implemented Interfaces:
jakarta.servlet.Servlet, jakarta.servlet.ServletConfig, Serializable
@Component public class CheckRequiredRolesServlet extends AbstractJsonServlet
Checks optional http parameter "require_roles". If parameter is set, at least one of comma-separated role needs to be available in logged in principal. Otherwise a forbidden status is returned. Can be used for logging in external services which require specific roles. Example: http://nginx.org/en/docs/http/ngx_http_auth_request_module.html Nginx config: 
 location /api {
     satisfy any;
     auth_basic "Restricted Access";
     auth_basic_user_file /etc/nginx/.htpasswd;
     auth_request /auth;

     auth_request_set $saved_set_cookie $upstream_cookie_nice_client_id;
     add_header Set-Cookie nice_client_id=$saved_set_cookie;
 }

 location = /auth {
     internal;

     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_set_header X-Forwarded-For $remote_addr;
     proxy_pass https://customer.tocco.ch/nice2/check-required-roles?require_roles=developer,web_admin;
     proxy_pass_request_body off;
     proxy_set_header Content-Length "";
     proxy_set_header X-Original-URI $request_uri;
 }
See Also: