title: Setting custom rest-authenticator in Activiti BPM rest-webapp
body: <p>we want to implement SSO in the Activiti BPM REST-API 5.15. I followed exactly the description of the Activiti documentation to disable the build in basic authentication: <a href="http://www.activiti.org/userguide/#N12F8B" rel="nofollow">http://www.activiti.org/userguide/#N12F8B</a>
  The goal is to replace the build in basic authentication of the REST-API with our own SSO-Logic. </p>
  
  <p>Therefore, we need to disable the build in rest basic authentication. To achieve this, I created a subclass of org.activiti.rest.service.application.ActivitiRestServicesApplication that implements the method boolean requestRequiresAuthentication(Request request) of the custom org.activiti.rest.common.filter.RestAuthenticator interface. Always returning false disables the basic authentication in theory. I addition, I read this post: <a href="http://forums.activiti.org/content/issue-custom-restauthenticator-using-rest-513" rel="nofollow">http://forums.activiti.org/content/issue-custom-restauthenticator-using-rest-513</a></p>
  
  <p>Here is my class:</p>
  
  <pre><code>package org.activiti.rest.service.application;
  
  import org.restlet.Request;
  import org.restlet.data.Form;
  
  import javax.crypto.Cipher;
  import javax.crypto.SecretKey;
  import javax.crypto.SecretKeyFactory;
  import javax.crypto.spec.DESedeKeySpec;
  import javax.crypto.spec.IvParameterSpec;
  import javax.crypto.spec.SecretKeySpec;
  
  import org.activiti.engine.identity.User;
  import org.activiti.engine.impl.identity.Authentication;
  import org.apache.commons.codec.binary.Base64;
  
  import java.security.Key;
  import java.security.MessageDigest;
  import java.security.spec.KeySpec;
  import java.util.Arrays;
  import java.util.Date;
  
  import org.activiti.rest.common.api.ActivitiUtil;
  import org.activiti.rest.common.filter.RestAuthenticator;
  
  public class CustomActivitiRestServicesApplication extends ActivitiRestServicesApplication implements RestAuthenticator {
  
      protected String ltpaKey;
      protected String ltpaPassword;
  
      private static final String AES_DECRIPTING_ALGORITHM = "AES/CBC/PKCS5Padding";
      private static final String DES_DECRIPTING_ALGORITHM = "DESede/ECB/PKCS5Padding";
      private static final String LTPA_COOKIE_NAME = "LtpaToken2";
      String ltpaToken = null;
  
      @Override
      public boolean requestRequiresAuthentication(Request request) {
  
             //LTPA-Encrypt-Logic
            //Authentication.setAuthenticatedUserId(user.getId());
          return false;
      }
  
      @Override
      public boolean isRequestAuthorized(Request request) {
          // TODO Auto-generated method stub
          return false;
      }
  }
  </code></pre>
  
  <p>In addition, I altered the web.xml of the activiti-webapp-rest2, that it points to my custom implementation:</p>
  
  <pre><code>&lt;!-- Restlet adapter --&gt;  
    &lt;servlet&gt;  
      &lt;servlet-name&gt;RestletServlet&lt;/servlet-name&gt;  
      &lt;servlet-class&gt;org.restlet.ext.servlet.ServerServlet&lt;/servlet-class&gt;
      &lt;init-param&gt;
        &lt;!-- Application class name --&gt;
        &lt;param-name&gt;org.restlet.application&lt;/param-name&gt;
        &lt;param-value&gt;org.activiti.rest.service.application.CustomActivitiRestServicesApplication&lt;/param-value&gt;
      &lt;/init-param&gt;
    &lt;/servlet&gt;
  </code></pre>
  
  <p>The Problem is, that this takes no effekt. After redeploying, the rest-api still wants to have basic credentials and I have no idea, why.</p>
  
  <p>Any reply is appreciated. I googled a lot but without success.</p>
  
  <p><strong><em>UPDATE:</em></strong> Maybe, this class could be helpful to set the custom REST-Authenticator:
  org.activiti.rest.common.application.ActivitiRestApplication</p>
  
  <p>there you can find the method:</p>
  
  <pre><code>// Set authenticator as a NON-optional filter. If certain request require no authentication, a custom RestAuthenticator
  // should be used to free the request from authentication.
  authenticator = new ChallengeAuthenticator(null, true, ChallengeScheme.HTTP_BASIC,
        "Activiti Realm") {
  
    @Override
    protected boolean authenticate(Request request, Response response) {
  
      // Check if authentication is required if a custom RestAuthenticator is set
      if(restAuthenticator != null &amp;&amp; !restAuthenticator.requestRequiresAuthentication(request)) {
        return true;
      }
  
      if (request.getChallengeResponse() == null) {
        return false;
      } else {
        boolean authenticated = super.authenticate(request, response);
        if(authenticated &amp;&amp; restAuthenticator != null) {
          // Additional check to see if authenticated user is authorised. By default, when no RestAuthenticator
          // is set, a valid user can perform any request.
          authenticated = restAuthenticator.isRequestAuthorized(request);
        }
        return authenticated;
      }
    }
  };
  authenticator.setVerifier(verifier);
  </code></pre>
  
  <p>}</p>
  
  <p>But I still do not understand how to "set" my custom rest authenticator.
  Any help is more than welcome
  Thanks a lot, Ben</p>