Headers based security and external authentication improvements

[mbarto]

No description provided.

[coveralls]

Coverage increased (+0.4%) to 34.304% when pulling e1a3881 on mbarto:headers_based_security into 90d4ff6 on geosolutions-it:master.

[offtherailz]

Looks good. 👍

Only a couple of questions:

1. If you want to switch you have to configure a both token authentication (to disable user retrival from service) and configure an headerfilter in context.
   Am I Right? This looks complicate. Is there a way to switch between the two set-ups configuring only one of them, or setting them in cascade, so checkToken is not called automatically'

2. Can you document a little bit how to configure HeaderAuthenticationFilter ( enable it, configure user and role mapping and so on...).
   this wiki is ok. So we can copy it on mapstore docs soon

[mbarto]

Example of config (that I am working on):

<security:http auto-config="true" create-session="never" >
    <security:http-basic entry-point-ref="restAuthenticationEntryPoint"/>
    <!--security:custom-filter ref="authenticationTokenProcessingFilter" before="FORM_LOGIN_FILTER"/-->
    <security:custom-filter ref="sessionTokenProcessingFilter" after="FORM_LOGIN_FILTER"/>
    <security:custom-filter ref="headersProcessingFilter" before="FORM_LOGIN_FILTER"/>
    <security:anonymous />
</security:http>

<security:authentication-manager>
    <security:authentication-provider ref='georchestraAuthenticationProvider' />
</security:authentication-manager>

<bean class="it.geosolutions.geostore.services.rest.security.HeadersAuthenticationFilter" id="headersProcessingFilter">
</bean>

<bean id="georchestraAuthenticationProvider" class="it.geosolutions.geostore.services.rest.security.PreAuthenticatedAuthenticationProvider">
</bean>

This is the way Spring Security works: we have a bit of complexity to allow a lot of flexibility.
I am going to add commented examples of configuration, like we have for other supported scenarios in the config xml.