From: Ray Lee <rhlee@berkeley.edu>
Date: Fri, 8 Dec 2017 05:17:21 +0000 (-0800)
Subject: DRYD-169: Change password reset and publicitems url access to permitAll.
X-Git-Url: https://git.aero2k.de/?a=commitdiff_plain;h=c3286c54028d10f5ebe9d6670be1054968806f3b;p=tmp%2Fjakarta-migration.git

DRYD-169: Change password reset and publicitems url access to permitAll.
---

diff --git a/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml
index 53bd28b0a..6587e9e35 100644
--- a/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml
+++ b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml
@@ -55,17 +55,17 @@
 
     <sec:http realm="org.collectionspace.services" create-session="stateless" authentication-manager-ref="userAuthenticationManager">
         <!-- Exclude the resource path to public items' content from AuthN and AuthZ. Lets us publish resources with anonymous access. -->
-        <sec:intercept-url pattern="/publicitems/*/*/content" access="isAnonymous()" />
-        
+        <sec:intercept-url pattern="/publicitems/*/*/content" access="permitAll" />
+
         <!-- Exclude the resource path to handle an account password reset request from AuthN and AuthZ. Lets us process password resets anonymous access. -->
-        <sec:intercept-url pattern="/accounts/requestpasswordreset" access="isAnonymous()" />
-        
+        <sec:intercept-url pattern="/accounts/requestpasswordreset" access="permitAll" />
+
         <!-- Exclude the resource path to account process a password resets from AuthN and AuthZ. Lets us process password resets anonymous access. -->
-        <sec:intercept-url pattern="/accounts/processpasswordreset" access="isAnonymous()" />
+        <sec:intercept-url pattern="/accounts/processpasswordreset" access="permitAll" />
 
         <!-- All other paths must be authenticated. -->
         <sec:intercept-url pattern="/**" access="isFullyAuthenticated()" />
-        
+
         <sec:http-basic />
         <sec:anonymous username="anonymous" />
         <sec:csrf disabled="true" />