fix sparql api authentication

TIBHannover · Apr 29, 2024 · 6b0a2d2 · 6b0a2d2
1 parent 1a28685
commit 6b0a2d2
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/api/src/main/java/edu/cornell/mannlib/vitro/webapp/controller/api/VitroApiServlet.java b/api/src/main/java/edu/cornell/mannlib/vitro/webapp/controller/api/VitroApiServlet.java
@@ -54,7 +54,12 @@ protected void confirmAuthorization(HttpServletRequest req,
 					+ "last names and a valid email address.");
 		}
 
-		if (!auth.isCurrentPasswordArgon2(account, password)) {
+		boolean credentialsProvided = auth.isCurrentPasswordArgon2(account, password);
+		//Check authorization if user is already authenticated or public access allowed
+		if (PolicyHelper.isAuthorizedForActions(req, requiredActions)) {
+		    return;
+		}
+		if (!credentialsProvided) {
 			log.debug("Invalid: '" + email + "'/'" + password + "'");
 			throw new AuthException("email/password combination is not valid");
 		}