To support restricted access, a web script can specify its authentication requirements. There are four levels of required authentication:
- The web script does not require any authentication to be invoked.
- The web script can be invoked by a guest user of the Alfresco content application server.
- The web script must be invoked by a named user known to the Alfresco content application server.
- The web script must be invoked by a named user who is an administrator of the Alfresco content application server.
An authenticated web script has access to all the services of the Alfresco content application server and thus can perform any operation, although it still adheres to the permissions of the authenticated user.
JSR-168 Authenticator only works if running on the repo tier, and it does not work for web scripts running in the Share tier. Surf has support for JSR-168 portlets built-in.