[SLING-11503] WebconsoleSecurityProvider: Force authentication against JCR

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Web Console Security Provider 1.2.4
• Fix Version/s: Web Console Security Provider 1.2.6
• Component/s: Extensions
• Assignee: Joerg Hoh
• Reporter: Joerg Hoh
• Created: 29/Jul/22 14:14
• Updated: 31/Aug/22 11:55
• Resolved: 01/Aug/22 08:20

Description

It should be possible to enforce an authentication against JCR even if SlingAuthentication is possible.

Assume that Sling Authentication is using SAML, but it still must be possible to authenticate against the JCR using local users.

This will just affect the authentication on the Webconsole!

To make this work we introduced a new framework property "sling.webconsole.authType" with 2 possible values:

• "slingAuth" (default): authenticate using Sling authentication
• "jcrAuth": authenticate against JCR using Basic Auth.