diff --git a/core/src/main/java/fr/sncf/osrd/cli/ApiServerCommand.java b/core/src/main/java/fr/sncf/osrd/cli/ApiServerCommand.java index b70246a4893..86cb8142fcf 100644 --- a/core/src/main/java/fr/sncf/osrd/cli/ApiServerCommand.java +++ b/core/src/main/java/fr/sncf/osrd/cli/ApiServerCommand.java @@ -42,7 +42,7 @@ public final class ApiServerCommand implements CliCommand { @Parameter( names = {"--editoast-authorization"}, description = "The HTTP Authorization header sent to editoast") - private String editoastAuthorization = "x-osrd-core"; + private String editoastAuthorization = "x-osrd-skip-authz"; @Parameter( names = {"-j", "--threads"}, diff --git a/core/src/main/java/fr/sncf/osrd/cli/WorkerCommand.kt b/core/src/main/java/fr/sncf/osrd/cli/WorkerCommand.kt index 1525b1123ac..e52a96c5718 100644 --- a/core/src/main/java/fr/sncf/osrd/cli/WorkerCommand.kt +++ b/core/src/main/java/fr/sncf/osrd/cli/WorkerCommand.kt @@ -38,7 +38,7 @@ class WorkerCommand : CliCommand { names = ["--editoast-authorization"], description = "The HTTP Authorization header sent to editoast" ) - private var editoastAuthorization: String = "x-osrd-core" + private var editoastAuthorization: String = "x-osrd-skip-authz" val WORKER_ID: String? val WORKER_ID_USE_HOSTNAME: Boolean diff --git a/editoast/src/views/mod.rs b/editoast/src/views/mod.rs index 7d28083d466..522c23f9e71 100644 --- a/editoast/src/views/mod.rs +++ b/editoast/src/views/mod.rs @@ -149,8 +149,8 @@ pub enum Authentication { Unauthenticated, /// The issuer of the request provided the 'x-remote-user-identity' header. Authenticated(Authorizer>), - /// The requests comes from a Core instance. All requests are considered safe. - Core, + /// The requests comes from a trusted service (like core). All requests are considered safe. + SkipAuthorization, } impl Authentication { @@ -162,7 +162,7 @@ impl Authentication { ) -> Result as editoast_authz::authorizer::StorageDriver>::Error> { match self { - Authentication::Core => Ok(true), + Authentication::SkipAuthorization => Ok(true), Authentication::Unauthenticated => Ok(false), Authentication::Authenticated(authorizer) => { authorizer.check_roles(required_roles).await @@ -176,7 +176,7 @@ impl Authentication { pub fn authorizer(self) -> Result>, AuthorizationError> { match self { Authentication::Authenticated(authorizer) => Ok(authorizer), - Authentication::Unauthenticated | Authentication::Core => { + Authentication::Unauthenticated | Authentication::SkipAuthorization => { Err(AuthorizationError::Unauthenticated) } } @@ -196,8 +196,8 @@ async fn authenticate( ))); } let Some(identity) = headers.get("x-remote-user-identity") else { - if headers.contains_key("x-osrd-core") { - return Ok(Authentication::Core); + if headers.contains_key("x-osrd-skip-authz") { + return Ok(Authentication::SkipAuthorization); } return Ok(Authentication::Unauthenticated); }; diff --git a/gateway/gateway.toml b/gateway/gateway.toml index 5984348b06e..612faf4aaa4 100644 --- a/gateway/gateway.toml +++ b/gateway/gateway.toml @@ -14,7 +14,7 @@ endpoint = "http://localhost:4317" prefix = "/api" upstream = "http://localhost:8090" require_auth = true -blocked_headers = ["x-osrd-core"] +blocked_headers = ["x-osrd-skip-authz"] [[targets]] upstream = "http://localhost:3000"