Hi,
I use one of the PL quickstarts - picketlink-authentication-jsf - and then add a custom authorizer. As the authentication in this example does not use any IDM, I want to do the same for authorization.
My config is like this:
SecurityConfigurationBuilder builder = event.getBuilder();
builder.http()
.forPath("/admin/*")
.authorizeWith().role("ADMIN").authorizer(CustomPathAuthorizer.class)
;
And then, my custom path authorize method is a trivial one:
if(((User)(identity.getAccount())).getLoginName().contains("admin")) {
return true;
}
return false;
No matter which user I logon to (jsmith or another user named admin1), I get a forbidden to the admin page. I have added a sysout and can see that, the authorize method returns true (and my admin.xhtml is placed inside the admin folder).
Please do provide me with some pointers, thanks.
(note: there is a similar thread done last year, but doesn't answer my question: Authorization for URLs with Login Form )
