1. Home
  2. Development
  3. Can't create anonymous REST services in 7.2?

Can't create anonymous REST services in 7.2?

Michael Freeman, modified 5 Years ago.
Can't create anonymous REST services in 7.2?
Junior Member Posts: 37 Join Date: 7/2/12 Recent Posts
It would appear that we can no longer create REST services using the CXF/REST extenders that are publicly accessible without authentication?
i.e. if I create a vanilla JAX-RS service and deploy it, i always get a 403 from Liferay when hitting the service unless i include BASIC AUTH headers with the request, and then i get the expected 200 return code.
Is this a side effect of the new Liferay CMS REST services that were delivered in 7.2?
thumbnail
Christoph Rabel, modified 5 Years ago.
RE: Can't create anonymous REST services in 7.2?
Liferay Legend Posts: 1555 Join Date: 9/24/09 Recent Posts
Did you use the old template for 7.0 and it does not work anymore? Or did you create a new Rest module based on Whiteboard?
If you use Whiteboard, those threads should help you. If not, I don't know, maybe you need to switch to whiteboard (or maybe those properties also help you)
https://liferay.dev/forums/-/message_boards/message/112794830
https://liferay.dev/forums/-/message_boards/message/117823352
Michael Freeman, modified 5 Years ago.
RE: Can't create anonymous REST services in 7.2?
Junior Member Posts: 37 Join Date: 7/2/12 Recent Posts
Wow.
So eventually grokking through those posts you provided was the answer. I had to add the whiteboard annotations AND use the control panel to include my endpoint in the system default policy...
I guess I have been asleep at the switch. Is there anything in the doco that describes the recommended switch from the old CXF/REST style of services to this pure whiteboard approach?
Michael Freeman, modified 5 Years ago.
RE: Can't create anonymous REST services in 7.2?
Junior Member Posts: 37 Join Date: 7/2/12 Recent Posts
Christoph
Can you explain a little more about this comment from the last post in the second thread:?
>> You can disable oauth (add  "oauth2.scopechecker.type=none" to the properties), but as you found out, you will be blocked by the access control.
>> To get around that, go to Control Panel -> Configuration -> Service Access Policy -> System_Default (it already contains getCountries and getRegions).
>> Add your own class/method to it.
>> package.itemsRESTApplication#working
>> or maybe even
>> package.itemsRESTApplication#*
>> if you want to allow access to all methods of your class.
So this works, but i am not sure why. Especially the part about "you will be blocked by the access control". Can you explain that a little more in detail?
Thanks