How to create a java AuthenticationRestClient for anonymous?

UAA
1

For some Integration tests with LOCAL authentication type I would like to also use a AuthenticationRestClient that acts as an anonymous user and call currentUser() for example. However when using the UaaRestClientAutoconfiguration with property mgm.uaa.authentication.client.rest.authentication-configuration.user-name having an empty string as value a login request is always approached but receives an Unauthorized on the client side.

When trying to do same with the browser I receive a response, for example in my case visiting http://localhost:9090/api/uaa-authentication/currentUser returns:

{
    "username": "anonymous",
    "eMail": null,
    "firstName": null,
    "lastName": null,
    "displayName": "anonymous",
    "accountNonExpired": true,
    "accountNonLocked": true,
    "credentialsNonExpired": true,
    "enabled": true,
    "roles": [{
            "name": "guest",
            "description": null,
            "accessRights": [{
                    "name": "MODEL_READ",
                    "description": null
                }, {
                    "name": "DOCUMENT_READ",
                    "description": null
                }, {
                    "name": "COSMO",
                    "description": null
                }
            ]
        }
    ]
}

I would like to get a similiar response with the AuthenticationRestClient when invoking currentUser(). How do I do that in a spring boot environment?

2

Hi,
this is impossible since the REST client always need auth token. If the token is missing then login flow is initiated.
Anonymous is working in a way they no token is required and principal is created by a server based on anonymous configuration. That’s why browser is working for currentUser endpoint

3

I added the following bean definition to my configuration:

	@Bean
	@ConditionalOnExpression("'${mgm.uaa.authentication.client.rest.authentication-configuration.user-name}' == ''")
	public ClientHttpRequestInterceptor authorizationInterceptor() {
		return (request, body, execution) -> execution.execute(request, body);
	}

and allowed overriding bean definitions. This way the authorizationInterceptor making the login request is overriden in the anonymous case but used if a non-anonymous user is configured.