Skip to content

Retire the WSSE AtomPub authentication mode - #166

Open
snoopdave wants to merge 1 commit into
masterfrom
retire-wsse-atompub-auth
Open

Retire the WSSE AtomPub authentication mode#166
snoopdave wants to merge 1 commit into
masterfrom
retire-wsse-atompub-auth

Conversation

@snoopdave

Copy link
Copy Markdown
Contributor

Roller's AtomPub endpoint supports a WSSE digest authentication mode that is no
longer used and is not maintained. This change removes it rather than carrying
it forward.

What changed

  • Remove wsse from the AtomPub authentication dispatch and delete the WSSE
    parser/generator utility, which has no other production caller.
  • Keep AtomPub and its supported authentication modes intact.
  • Fail closed when an existing installation still has
    webservices.atomPubAuth=wsse (or any other unsupported value); never silently
    reinterpret that value as Basic authentication.
  • Remove WSSE from the administrator-facing AtomPub authentication labels.
  • No persistence manager, entity, table, schema migration, cache, or cluster
    coordination is required.

Tests

  • With webservices.atomPubAuth=wsse, a request stays unauthenticated and does
    not fall back to Basic authentication.
  • No production code or administrator-facing label references WSSE.
  • The application compiles on JDK 11 and existing AtomPub authentication tests
    pass.

WSSE has no other production caller; AtomPub retains Basic and OAuth authentication.

Claude-Session: https://claude.ai/code/session_01A1fhY1E2PCFU6UAPXu2WtV
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant