support client login and calls to api through jQuery.

mifosng-provider/src/main/java/org/mifosng/platform/api/AuthenticationApiResource.java

@@ -0,0 +1,56 @@
+package org.mifosng.platform.api;
+
+import java.util.ArrayList;
+import java.util.Collection;
+
+import javax.ws.rs.Consumes;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+
+import org.mifosng.data.AuthenticatedUserData;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.context.annotation.Scope;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.stereotype.Component;
+
+@Path("/v1/authentication")
+@Component
+@Scope("singleton")
+public class AuthenticationApiResource {
+
+	@Qualifier("customAuthenticationProvider")
+    @Autowired
+	private DaoAuthenticationProvider customAuthenticationProvider;
+    
+    @POST
+	@Consumes({MediaType.APPLICATION_XML})
+    @Produces({MediaType.APPLICATION_XML})
+	public Response authenticate(@QueryParam("username") final String username, @QueryParam("password") final String password) {
+
+    	Authentication authentication = new UsernamePasswordAuthenticationToken(username, password);
+    	Authentication authenticationCheck = customAuthenticationProvider.authenticate(authentication);
+    	
+    	Collection<String> permissions = new ArrayList<String>();
+		AuthenticatedUserData authenticatedUserData = new AuthenticatedUserData(permissions);
+		authenticatedUserData.setUsername(username);
+		
+		if (authenticationCheck.isAuthenticated()) {
+			Collection<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>(authenticationCheck.getAuthorities());
+			for (GrantedAuthority grantedAuthority : authorities) {
+				permissions.add(grantedAuthority.getAuthority());
+			}
+			authenticatedUserData.setPermissions(permissions);
+			authenticatedUserData.setAuthenticated(true);
+		}
+    	
+		return Response.ok().entity(authenticatedUserData).build();
+	}
+}

mifosng-provider/src/main/java/org/mifosng/platform/security/SpringSecurityPlatformSecurityContext.java

@@ -11,7 +11,7 @@ import org.springframework.stereotype.Service;
  * Responsible for returning the current authenticated user that is currently set in the {@link SecurityContext}.
  */
 @Service
-public class PlatformSecurityContextThroughSpringSecurity implements PlatformSecurityContext {
+public class SpringSecurityPlatformSecurityContext implements PlatformSecurityContext {
 
 	@Override
 	public AppUser authenticatedUser() {

mifosng-provider/src/main/resources/META-INF/spring/securityContext.xml

@@ -1,15 +1,20 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <beans:beans xmlns="http://www.springframework.org/schema/security"
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:beans="http://www.springframework.org/schema/beans"
-	xmlns:sec="http://www.springframework.org/schema/security"
 	xsi:schemaLocation="
    http://www.springframework.org/schema/security 
    http://www.springframework.org/schema/security/spring-security-3.1.xsd
    http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans-3.1.xsd">
 
+	<http security="none" pattern="/api/*/authentication" />
+
 	<http create-session="stateless" use-expressions="true" pattern="/api/**">
-	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" />
+	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="GET"/>
+	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="POST"/>
+	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="PUT"/>
+	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="DELETE"/>
+	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="HEAD"/>
 	   <http-basic />
 	</http>