Securing a Groovy API
Martini leverages Spring MVC and Spring Security features to implement method-level security on HTTP APIs written using Groovy.
Getting started
Consider the following Groovy code:
1 2 3 4 5 6 7 8 9 |
|
This exposes an HTTP endpoint on /api/lannister/welcome
that simply returns "Welcome home"
. We can
verify this by issuing a cURL command:
1 |
|
This responds with:
1 |
|
Our goal for this example is to limit access to this endpoint. We can secure this endpoint by applying the
@Secured
annotation.
1 2 3 4 5 6 7 8 9 10 11 12 |
|
Resolvable method parameters
The above code also introduces the injection of java.security.Principal
object in the method parameter. This allows us later to query the name of the authenticated user and append it
to the "Welcome home"
response.
Making the cURL command again yields:
1 2 3 4 5 |
|
At this point, the endpoint is now secured1. Only a User
with the username Jaime
can
access the endpoint. By using Jaime
's access token retrieved via OAuth 2.0,
we can execute:
1 2 3 |
|
... to which the server responds:
1 |
|
Using Basic
Martini also supports the Basic authentication scheme. Assuming you have it enabled, you can receive the same response with (using your user's configured credentials):
1 2 |
|
Access control lists
When implementing security requirements, it's often more manageable to organize a set of permissions into a single logical group. Consider a requirement change in the previous example, where more users are allowed to access the HTTP endpoint. By creating a group that consists of the users:
- Jaime
- Cersei
- Tyrion
- Tywin
We can assign the group's name on the @Secured
annotation in the code, as in:
1 2 3 4 5 6 7 8 9 10 11 12 |
|
The endpoint /api/lannister/welcome
then becomes accessible only for authentication requests from registered
users under the group Lannister
.
Class level annotation
Like the @RequestMapping
, you can also add @Secured
at class level. This applies the access restrictions
to all methods in the class.
-
In Runtime Edition, accessing the secured endpoint in the browser (i.e.: GET request) with a user logged-in in the Runtime Admin UI is allowed. This is due to Marketplace credentials containing greater authorization than Martini users. ↩