Restlet: Adding a role depending on which 'project' (group) the user is accessing

Question

Assume a blackboard type application. There are 2 Projects - ProjectA and ProjectB. User 'nupul' (me) is part of both projects. For A I'm an admin and for B I'm just a 'member' (no admin rights)

When accessing the resource at /MySite/ProjectA/Items I want to check if the user is an admin or not.

I know it can be simply done by picking out the {projectName} parameter from the request and using the identifier (of the user making the request) and forwarding that to check against a DB etc.,

My question is 'how' can I add the roles using an Enroler 'during' authentication itself. Since I don't have access to the {projectName} parameter at that stage. I don't know if you have to use Groups/Realms etc., to make this work, but honestly it's just taking me tooooooooooooooooooo long to even understand how to effectively use this? (i.e., before the request is forwarded to the resource)

I mean I know I can create these groups/realms but how do I access the correct 'role' from the resource???? Restlet seriously needs to have more realistic examples and a much better documentation showing the use of it's classes!! It's driving me insane!! Authentication shouldn't be THIS DIFFICULT! :)

Answer 1

The way to do what you want is to split your routers basing on project name within your application (method createInboundRoot). In this case, the projectname will be evaluated before calling the authenticator. See below some examples of implementing such approach:

public Restlet createInboundRoot() {
    Router rootRouter = new Router(getContext());
    rootRouter.setDefaultMatchingMode(Template.MODE_STARTS_WITH);

    rootRouter.attach("/{projectname}/", createApplicationForProject());
    return rootRouter;
}

private Restlet createApplicationForProject() {
    Router router = new Router(getContext());

    ChallengeAuthenticator guard
             = new ChallengeAuthenticator(getContext(),
                        ChallengeScheme.HTTP_BASIC, "realm");
    guard.setVerifier(verifier);
    guard.setEnroler(enroler);
    guard.setNext(router);

    router.attach("items", ItemsServerResource.class);
    return guard;
}

Using such approach, you'll have access to the value of the projectname variable within the verifier and be able to use it in the authentication processing.

Hope it helps you, Thierry