Have Authorizers been executed even if no Authenticator is enabled

[dev-indb]

I wrote a custom Authorizer plugin for RESTHeart 5.1.5 version but method isAllowed is never called when I try to work directly in my IDE and RESTHeart project source code
I can see the plugin is correctly registered in log file.

fileAclAuthorizer is enabled in the conf file and the attribute enabledByDefault is equals to true of @registerPlugin annotation

I found a long entry with this message : "No Authentication Mechanisms defined"

I enabled tokenBasicAuthMechanism and the plugin works correctly.

In my plugin, I return false to isAuthenticationRequired
That's why the plugin code is not processed by the handler

This means that the authorizer code is processed if and only if there is at least one authentication mechanism.
That sounds good to me

Maybe an isAuthorizationRequired method could load the security context too ?

[ujibang]

Currently the authorization logic is executed if and only if there is at least one authentication mechanism.

We will modify this behavior in RESTHeart 6.2 to execute authorization logic if the request handling service is secured (i.e. its definition specifies the attribute secure=true or its configuration specifies secured: true)

This will allow to configure no auth mechanism but still authorizes requests (for instance, based on remote ip address).

To reproduce the current behavior the authorizer fullAuthorizer (that just authorizes any request) can be enabled.

[ujibang]

Done in commit 23bd408, will be part of RESTHeart 6.2

@dev-indb You can try it now using snapshot builds

[dev-indb]

Thank you for all this work @ujibang
I'll test it as soon as possible and give you feedback