[midPoint-git] [Evolveum/midpoint] da667e: Make REST authorizations finer-grained

[mederly]

  Branch: refs/heads/tmp/detailed-rest-autz
  Home:   https://github.com/Evolveum/midpoint
  Commit: da667ef7debff76ef5e496913b85634ec2ec0650
      https://github.com/Evolveum/midpoint/commit/da667ef7debff76ef5e496913b85634ec2ec0650
  Author: Pavol Mederly <mederly at evolveum.com>
  Date:   2024-02-13 (Tue, 13 Feb 2024)

  Changed paths:
    M model/authentication-impl/src/main/java/com/evolveum/midpoint/authentication/impl/util/EndPointsUrlMapping.java
    M model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/security/SecurityHelper.java
    M model/rest-impl/src/main/java/com/evolveum/midpoint/rest/impl/AbstractRestController.java
    M model/rest-impl/src/main/java/com/evolveum/midpoint/rest/impl/ClusterRestController.java
    M model/rest-impl/src/main/java/com/evolveum/midpoint/rest/impl/ExtensionSchemaRestController.java
    M model/rest-impl/src/main/java/com/evolveum/midpoint/rest/impl/ModelRestController.java
    M repo/repo-test-util/src/main/java/com/evolveum/midpoint/test/DummyAuditService.java
    A repo/security-api/src/main/java/com/evolveum/midpoint/security/api/RestMethod.java
    M repo/security-enforcer-api/src/main/java/com/evolveum/midpoint/security/enforcer/api/SecurityEnforcer.java
    M testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/AbstractRestServiceInitializer.java
    M testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/RestServiceInitializer.java
    M testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/TestAbstractRestService.java
    A testing/rest/src/test/resources/repo/role-rest-limited.xml
    A testing/rest/src/test/resources/repo/user-rest-limited.xml

  Log Message:
  -----------
  Make REST authorizations finer-grained

While "rest-3#all" authorization still exists, it is no longer
required to use it when only a subset of REST methods is to be
accessed by particular client. Each method has now its own
authorization.

Related change: Due to the current authentication architecture
in midPoint, these authorizations are checked in the respective
methods' bodies. So, if an unauthorized method is called, the
"login success" is audited, but the operation immediately fails.
The failure is recorded in the termination (logout) event. And
this is the change: the logout event now contains the real status
of the whole operation. (Previously, it was always SUCCESS.)