From 24fa8c97bdb8034af7155ca8928d22804a68537a Mon Sep 17 00:00:00 2001
From: Tim Wagner <t.wagner@techdivision.com>
Date: Fri, 11 May 2018 19:10:15 +0200
Subject: [PATCH] Refactor StandardSecurityManager to make configuration of
 security constraints simpler

---
 CHANGELOG.md                                  | 10 ++++++++
 build.default.properties                      |  2 +-
 .../ServletEngine/Security/Realm.php          |  1 -
 .../StandardAuthenticationManager.php         | 23 +++++++++----------
 4 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c1d1329f..b317abd4b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,13 @@
+Version 1.1.5-beta9
+
+## Bugfixes
+
+* None
+
+## Features
+
+* Refactor StandardSecurityManager to make configuration of security constraints simpler
+
 Version 1.1.5-beta8
 
 ## Bugfixes
diff --git a/build.default.properties b/build.default.properties
index cf711c986..f9f32cc32 100644
--- a/build.default.properties
+++ b/build.default.properties
@@ -8,7 +8,7 @@
 ;--------------------------------------------------------------------------------
 
 ; ---- Module Release Settings --------------------------------------------------
-release.version = 1.1.5-beta8
+release.version = 1.1.5-beta9
 release.name = Iron Knight
 
 ; ---- PHPCPD Settings ----------------------------------------------------------
diff --git a/src/AppserverIo/Appserver/ServletEngine/Security/Realm.php b/src/AppserverIo/Appserver/ServletEngine/Security/Realm.php
index e06290749..d92f9a56a 100644
--- a/src/AppserverIo/Appserver/ServletEngine/Security/Realm.php
+++ b/src/AppserverIo/Appserver/ServletEngine/Security/Realm.php
@@ -32,7 +32,6 @@
 use AppserverIo\Psr\Security\Auth\Callback\CallbackHandlerInterface;
 use AppserverIo\Appserver\Naming\Utils\NamingDirectoryKeys;
 use AppserverIo\Appserver\ServletEngine\Security\Utils\Util;
-use AppserverIo\Appserver\Core\Api\Node\SecurityDomainNodeInterface;
 use AppserverIo\Appserver\ServletEngine\Security\Auth\Callback\SecurityAssociationHandler;
 use AppserverIo\Psr\Security\Auth\Login\SecurityDomainConfigurationInterface;
 
diff --git a/src/AppserverIo/Appserver/ServletEngine/Security/StandardAuthenticationManager.php b/src/AppserverIo/Appserver/ServletEngine/Security/StandardAuthenticationManager.php
index 68c4841b8..0ea6f8fc6 100644
--- a/src/AppserverIo/Appserver/ServletEngine/Security/StandardAuthenticationManager.php
+++ b/src/AppserverIo/Appserver/ServletEngine/Security/StandardAuthenticationManager.php
@@ -216,7 +216,7 @@ public function handleRequest(HttpServletRequestInterface $servletRequest, HttpS
                     // this resource has to be omitted
                     $authenticated = false;
 
-                } elseif (in_array($servletRequest->getMethod(), $mapping->getHttpMethods())) {
+                } elseif (in_array($servletRequest->getMethod(), $mapping->getHttpMethods()) || sizeof($mapping->getHttpMethods()) === 0) {
                     // load the authentication method and authenticate the request
                     $authenticator = $this->getAuthenticator($mapping);
 
@@ -244,19 +244,18 @@ public function handleRequest(HttpServletRequestInterface $servletRequest, HttpS
                             throw new SecurityException(sprintf('User doesn\'t have necessary privileges for resource %s', $servletRequest->getUri()), 403);
                         }
                     }
+                }
 
-                } else {
-                    // load the session
-                    if ($session = $servletRequest->getSession(true)) {
-                        //  start it, if not already done
-                        if ($session->isStarted() === false) {
-                            $session->start();
-                        }
+                // load the session
+                if ($session = $servletRequest->getSession(true)) {
+                    //  start it, if not already done
+                    if ($session->isStarted() === false) {
+                        $session->start();
+                    }
 
-                        // and query whether or not the session contains a user principal
-                        if ($session->hasKey(Constants::PRINCIPAL)) {
-                            $servletRequest->setUserPrincipal($session->getData(Constants::PRINCIPAL));
-                        }
+                    // and query whether or not the session contains a user principal
+                    if ($session->hasKey(Constants::PRINCIPAL)) {
+                        $servletRequest->setUserPrincipal($session->getData(Constants::PRINCIPAL));
                     }
                 }