Hi everybody.

We are using Liferay DXP 7.1 and created a module which provides a REST API with JAX-RS. These endpoints are currently used by two application types:

• A native, third-party mobile app (iOS and Android), authenticating via OAuth 2
• Liferay portlets, which dynamically load and update front-end data (AJAX), authenticating via the user's existing portal session

On our live system, both authentication methods work as expected: The third-party app is working as expected via OAuth2, and our portal users can use the different portlets just by logging in before.

So, basically, nothing to complain about. But: on two of four local development systems, it is not possible to use the existing portal session, i.e., if we load one of these portlets, they don't receive any data, the AJAX request is rejected with a 401 (Unauthorized). Via Postman we explored that OAuth2 and even BasicAuth (https://username:password@localhost:8080/...etc...) are working anyway. Further research showed up, that the 401 is not caused by Liferay (so the access to our endpoint is allowed), but that not the current user is set but the Liferay default user, so that our own security checks reply with 401.

Until now, we were not able to figure out what's the difference between our development systems, the general setup (IDE, Liferay version, workspace, ...) should be absolutely the same. Obviously, we are missing something or overlook a change we did, and you can imagine that we afraid to accidentally cause this issue on our live system as well (or even worse: that our misunderstanding how the authentication should work may lead to security issues).

Thus, our question is: Does somebody know what may cause this issue? Why is the existing user session used on two of our systems, while two other systems automatically choose the Liferay default user? Can you give us a hint were to continue our research? Of course, I add all the information we already collected below.

Any help or hint is appreciated. Thanks in advance!
André


1. The JAX-RS Application

@Component(immediate = true,
        property = {"javax.portlet.resource-bundle=content.Language",
                JaxrsWhiteboardConstants.JAX_RS_APPLICATION_BASE + "=/community-rest-service",
                JaxrsWhiteboardConstants.JAX_RS_NAME + "=community.rest", "oauth2.scopechecker.type=annotations"},
        service = Application.class)
public class CommunityRestServiceApplication extends Application {
    
    @Reference(target = ModuleServiceLifecycle.PORTAL_INITIALIZED,
            unbind = "-")
    protected void setModuleServiceLifecycle(ModuleServiceLifecycle moduleServiceLifecycle) {
        
        // Empty body, module lifecycle is set by the annotation.
        // This is a workaround to load this module after the portal has initialized.
    }
    
    @Override
    public Set<object> getSingletons() {
        
        Set<object> singletons = new HashSet&lt;&gt;();
        
        singletons.add(new JacksonJaxbJsonProvider());
        
        singletons.add(new PartialJsonObjectPatchReader());
        
        singletons.add(new BlogsEntryAPIServiceImpl());
        singletons.add(new EventAPIServiceImpl());
        singletons.add(new FiscalperiodAPIServiceImpl());
        singletons.add(new MemberAPIServiceImpl());
        singletons.add(new MembershipTypeAPIServiceImpl());
        singletons.add(new MyAccountAPIServiceImpl());
        singletons.add(new ResourceAPIServiceImpl());
        singletons.add(new UserAPIServiceImpl());
        
        return singletons;
    }
    
}<strong>2. Endpoints Interface Example</strong><br><br><pre><code>@GET
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
Response getBlogsEntries(@Context HttpServletRequest httpServletRequest, @Context SecurityContext securityContext,
        @QueryParam("groupId") long groupId, @DefaultValue("1") @QueryParam("page") int page,
        @DefaultValue("10") @QueryParam("count") int count);</code></pre><strong>3. Getting user details while executing</strong><br>Of course, we tried to debug our existing solution. By this, as already explained, we realized, that the connection is not denied by Liferay itself. Within our endpoint, we added some more security checks to make sure this is not just a valid user session, but the user is allowed to view the requested content as well.<br>On our working systems, we can get the the correct user ID within our endpoints:<br><br><pre><code>long requestingUserId = Long.[i]parseLong[/i](securityContext.getUserPrincipal().getName());</code></pre>On the broken systems, this always leads to the "Liferay default user", who has no permissions granted on any site or content. So, our permission checks lead to the 401.<br><br><strong>4. Service Access Policies</strong><br>Because of what I described before, we checked our Service Access Policies. But also there we could not identify anything odd.<br>SYSTEM_DEFAULT and SYSTEM_USER_PASSWORD show the default setup:<br><br><img src="/documents/portlet_file_entry/14/image--tempRandomSuffix--gEClRCqJ.png/ce53165d-0e10-c2ae-6bc7-7cc61eb211e4"><img src="/documents/portlet_file_entry/14/image--tempRandomSuffix--noRmeSLe.png/6318ddbc-5abb-2d1d-7c82-424191c87d91"><br>My understanding is, that if our service would be captured by SYSTEM_DEFAULT and not by SYSTEM_USER_PASSWORD, this may cause the describe behavior, but as you can see, this is not the case.<br>The only Service Access Policies with "Default" set to true are ASSET_ENTRY_DEFAULT, CALENDAR_DEFAULT&nbsp;and SYSTEM_DEFAULT, so this is as expected.<br><br><strong>5. Another JAX-RS service</strong><br>Within another module, we define a second JAX-RS service. <strong>I don't think this causes the issue</strong> (because it is also deployed on the working systems), but just to be sure I don't miss anything, I add some information about this one as well.<br><br>This service is intended to authenticate via Basic Auth, because it delivers a iCalendar file (*.ics), and calendar software like Outlook, Apple Calendar, etc. should be able to subscribe to this calendar. The current setup is not yet working as expected (this is not topic of this thread, for this I'll create a separate one ;-)), but the Component annotation look like this:<br><pre><code>@Component(immediate = true,
        property = {"javax.portlet.resource-bundle=content.Language",
                JaxrsWhiteboardConstants.JAX_RS_APPLICATION_BASE + "=/upcoming-events-rest-service",
                JaxrsWhiteboardConstants.JAX_RS_NAME + "=upcoming-events.rest",
                "auth.verifier.auth.verifier.BasicAuthHeaderAuthVerifier.basic_auth=true"
        },
        service = Application.class)</code></pre></object></object>