Clarify services authentication

[ebruchez]

We document how to authenticate with a service, but when using header-based auth, the Form Runner auth filter is not able to obtain user information unless it's passed as headers as well. In the case of Liferay, in particular, in the same orbeon.war, the user must pass the same Orbeon-Liferay-User-Credentials Liferay header, which is in JSON format.

This must be:

• documented and clarified
• improved, so as to be more flexible
  • maybe multiple headers can be configured? maybe when delegating auth, the user info can be returned by the authenticator (#1872)?

+1 from customer

See also #1872 #2321 which touches on the same issue. But did anything change since then?

[ebruchez]

Ok, it turns out that not everything above is correct. If a Orbeon-Liferay-User-Credentials header has a non-blank value, then it will be used. Otherwise, the individual headers are checked. This means that:

• Liferay requests can use Orbeon-Liferay-User-Credentials
• service API calls could use individual headers, with a different configuration