From 0924304cf55a8819f819c12d1aafdb788cef0eb4 Mon Sep 17 00:00:00 2001
From: Jared Whiklo <jwhiklo@gmail.com>
Date: Wed, 3 May 2017 11:51:22 -0500
Subject: [PATCH] Add attribute to allow anonymous GET requests through Syn
 (#9)

* Add attribute to allow anonymous GET requests through Syn

* Additional tests

* Also check HEAD

Clean up allow anonymous checks
---
 .gitignore                                    |   1 +
 conf/syn-settings.example.xml                 |   3 +
 .../syn/settings/SettingsParser.java          |  63 +--
 .../java/ca/islandora/syn/settings/Site.java  |  19 +
 .../java/ca/islandora/syn/valve/SynValve.java |  63 ++-
 .../SettingsParserAlgorithmsTest.java         |  82 +++-
 .../settings/SettingsParserAnonymousTest.java |  76 ++++
 .../settings/SettingsParserDigestTest.java    |  55 ++-
 .../ca/islandora/syn/settings/SiteTest.java   |  15 +-
 .../ca/islandora/syn/valves/SynValveTest.java | 366 ++++++++++++++++--
 10 files changed, 676 insertions(+), 67 deletions(-)
 create mode 100644 src/test/java/ca/islandora/syn/settings/SettingsParserAnonymousTest.java

diff --git a/.gitignore b/.gitignore
index 69857f2..f44f385 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@
 /build
 *.ipr
 *.iws
+/bin/
diff --git a/conf/syn-settings.example.xml b/conf/syn-settings.example.xml
index 191ea2a..3cbd328 100644
--- a/conf/syn-settings.example.xml
+++ b/conf/syn-settings.example.xml
@@ -16,6 +16,9 @@ my secret key
   <!-- A site with a key stored in a file -->
   <site url='http://test2.com' algorithm='HS256' encoding='base64' path='/somewhere/on/filesystem.key'/>
 
+  <!-- A site that allows all GET requests  -->
+  <site url='http://test3.com' algorithm='HS256' encoding='plain' anonymous='true'/>
+
   <!-- 
   This is how you specify a default site, which will be chosen if no 
   other site matches the JWT url claim
diff --git a/src/main/java/ca/islandora/syn/settings/SettingsParser.java b/src/main/java/ca/islandora/syn/settings/SettingsParser.java
index 49c375e..92e25b5 100644
--- a/src/main/java/ca/islandora/syn/settings/SettingsParser.java
+++ b/src/main/java/ca/islandora/syn/settings/SettingsParser.java
@@ -1,12 +1,12 @@
 package ca.islandora.syn.settings;
 
-import com.auth0.jwt.algorithms.Algorithm;
-import org.apache.juli.logging.Log;
-import org.apache.juli.logging.LogFactory;
-import org.apache.tomcat.util.digester.Digester;
-import org.bouncycastle.util.io.pem.PemObject;
-import org.bouncycastle.util.io.pem.PemReader;
-import org.xml.sax.SAXException;
+import java.io.File;
+import java.io.FileNotFoundException;
+import java.io.FileReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.Reader;
+import java.io.StringReader;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 import java.security.KeyFactory;
@@ -15,13 +15,16 @@
 import java.util.Base64;
 import java.util.HashMap;
 import java.util.Map;
-import java.io.File;
-import java.io.Reader;
-import java.io.StringReader;
-import java.io.FileReader;
-import java.io.FileNotFoundException;
-import java.io.IOException;
-import java.io.InputStream;
+import java.util.stream.Collectors;
+
+import org.apache.juli.logging.Log;
+import org.apache.juli.logging.LogFactory;
+import org.apache.tomcat.util.digester.Digester;
+import org.bouncycastle.util.io.pem.PemObject;
+import org.bouncycastle.util.io.pem.PemReader;
+import org.xml.sax.SAXException;
+
+import com.auth0.jwt.algorithms.Algorithm;
 
 public final class SettingsParser {
     private static Digester digester = null;
@@ -250,23 +253,37 @@ public static Map<String, Algorithm> getSiteAlgorithms(final InputStream setting
     }
 
     public static Map<String, Token> getSiteStaticTokens(final InputStream settings) {
-        final Map<String, Token> tokens = new HashMap<>();
         final Config sites = getSites(settings);
         if (sites == null) {
-            return tokens;
+            return new HashMap<String, Token>();
         }
 
-        for (Token token : sites.getTokens()) {
-            if (token.getToken().isEmpty()) {
-                log.error("Static token is empty ignoring.");
-            } else {
-                tokens.put(token.getToken(), token);
-            }
-        }
+        final Map<String, Token> tokens = sites.getTokens().stream().filter(x -> !x.getToken().isEmpty())
+            .collect(Collectors.toMap(Token::getToken, t -> t));
 
         return tokens;
     }
 
+    /**
+     * Build a list of site urls that allow anonymous GET requests.
+     *
+     * @param settings the path to the syn-settings file
+     * @return list of site urls.
+     */
+    public static Map<String, Boolean> getSiteAllowAnonymous(final InputStream settings) {
+        final Config sites = getSites(settings);
+        if (sites == null) {
+            return new HashMap<String, Boolean>();
+        }
+
+        final Map<String, Boolean> anonymousAllowed = sites.getSites().stream().filter(s -> !s.getDefault())
+            .collect(Collectors.toMap(Site::getUrl, Site::getAnonymous));
+        sites.getSites().stream().filter(Site::getDefault).findFirst()
+            .ifPresent(s -> anonymousAllowed.put("default", s.getAnonymous()));
+
+        return anonymousAllowed;
+    }
+
     static Config getSitesObject(final InputStream settings)
             throws IOException, SAXException {
         return (Config) getDigester().parse(settings);
diff --git a/src/main/java/ca/islandora/syn/settings/Site.java b/src/main/java/ca/islandora/syn/settings/Site.java
index 1ff9da3..1524282 100644
--- a/src/main/java/ca/islandora/syn/settings/Site.java
+++ b/src/main/java/ca/islandora/syn/settings/Site.java
@@ -7,6 +7,7 @@ public class Site {
     private String path = null;
     private String encoding = null;
     private boolean defaultItem = false;
+    private boolean allowAnonymous = false;
 
     public String getUrl() {
         return this.url;
@@ -49,4 +50,22 @@ public boolean getDefault() {
     public void setDefault(final boolean defaultItem) {
         this.defaultItem = defaultItem;
     }
+
+    /**
+     * Allow GET requests without a token that match this site.
+     *
+     * @return whether to allow the request
+     */
+    public boolean getAnonymous() {
+        return this.allowAnonymous;
+    }
+
+    /**
+     * Set allow GET requests with a token that match this site.
+     *
+     * @param allowAnonGet boolean whether to allow these requests.
+     */
+    public void setAnonymous(final boolean allowAnonGet) {
+        this.allowAnonymous = allowAnonGet;
+    }
 }
diff --git a/src/main/java/ca/islandora/syn/valve/SynValve.java b/src/main/java/ca/islandora/syn/valve/SynValve.java
index e198fd6..6d0158a 100644
--- a/src/main/java/ca/islandora/syn/valve/SynValve.java
+++ b/src/main/java/ca/islandora/syn/valve/SynValve.java
@@ -1,16 +1,15 @@
 package ca.islandora.syn.valve;
 
-import ca.islandora.syn.settings.SettingsParser;
-import ca.islandora.syn.settings.Token;
-import ca.islandora.syn.token.Verifier;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
+
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletResponse;
-import com.auth0.jwt.algorithms.Algorithm;
+
 import org.apache.catalina.LifecycleException;
 import org.apache.catalina.connector.Request;
 import org.apache.catalina.connector.Response;
@@ -20,6 +19,12 @@
 import org.apache.juli.logging.LogFactory;
 import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
 
+import com.auth0.jwt.algorithms.Algorithm;
+
+import ca.islandora.syn.settings.SettingsParser;
+import ca.islandora.syn.settings.Token;
+import ca.islandora.syn.token.Verifier;
+
 public class SynValve extends ValveBase {
 
     private String pathname = "conf/syn-settings.xml";
@@ -27,6 +32,8 @@ public class SynValve extends ValveBase {
     private Map<String, Algorithm> algorithmMap = null;
     private Map<String, Token> staticTokenMap = null;
 
+    private Map<String, Boolean> anonymousGetMap = null;
+
     @Override
     public void invoke(final Request request, final Response response)
             throws IOException, ServletException {
@@ -36,7 +43,7 @@ public void invoke(final Request request, final Response response)
 
         if ((constraints == null
                 && !request.getContext().getPreemptiveAuthentication())
-                || !hasAuthConstraint(constraints)) {
+            || !hasAuthConstraint(constraints)) {
             this.getNext().invoke(request, response);
         } else {
             handleAuthentication(request, response);
@@ -105,6 +112,15 @@ private boolean doAuthentication(final Request request) {
         }
     }
 
+    private void setAnonymousRoles(final Request request) {
+        final List<String> roles = new ArrayList<String>();
+        roles.add("anonymous");
+        roles.add("islandora");
+        final String name = "anonymous";
+        final GenericPrincipal principal = new GenericPrincipal(name, null, roles);
+        request.setUserPrincipal(principal);
+    }
+
     private void setUserRolesFromStaticToken(final Request request, final Token token) {
         final List<String> roles = token.getRoles();
         roles.add("islandora");
@@ -124,13 +140,47 @@ private void setUserRolesFromToken(final Request request, final Verifier verifie
 
     private void handleAuthentication(final Request request, final Response response)
             throws IOException, ServletException {
-        if (doAuthentication(request)) {
+        if ((request.getMethod().equalsIgnoreCase("GET") ||
+            request.getMethod().equals("HEAD")) &&
+            allowGetRequests(request.getHost().toString())) {
+            // Skip authentication
+            setAnonymousRoles(request);
+            this.getNext().invoke(request, response);
+        } else if (doAuthentication(request)) {
             this.getNext().invoke(request, response);
         } else {
             response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Token authentication failed.");
         }
     }
 
+    /**
+     * Do the logic of allowing GET/HEAD requests.
+     *
+     * @param requestURI the site being requested
+     * @return whether to allow GET requests without authentication.
+     */
+    private boolean allowGetRequests(final String requestURI) {
+        // If there is a matching site URI, return its value
+        if (anonymousGetMap.containsKey(requestURI)) {
+            log.debug(
+                String.format(
+                    "Using site anonymous ({}) for GET/HEAD requests, site {}",
+                    anonymousGetMap.get(requestURI),
+                    requestURI));
+            return anonymousGetMap.get(requestURI);
+            // Else if there is a default, return its value.
+        } else if (anonymousGetMap.containsKey("default")) {
+            log.debug(
+                String.format(
+                    "Using default anonymous ({}) for GET/HEAD requests, host {}",
+                    anonymousGetMap.get("default"),
+                    requestURI));
+            return anonymousGetMap.get("default");
+        }
+        // Else disallow anonymous.
+        return false;
+    }
+
     public String getPathname() {
         return pathname;
     }
@@ -155,6 +205,7 @@ public synchronized void startInternal() throws LifecycleException {
         try {
             this.algorithmMap = SettingsParser.getSiteAlgorithms(new FileInputStream(file));
             this.staticTokenMap = SettingsParser.getSiteStaticTokens(new FileInputStream(file));
+            this.anonymousGetMap = SettingsParser.getSiteAllowAnonymous(new FileInputStream(file));
         } catch (Exception e) {
             throw new LifecycleException("Error parsing XML Configuration", e);
         }
diff --git a/src/test/java/ca/islandora/syn/settings/SettingsParserAlgorithmsTest.java b/src/test/java/ca/islandora/syn/settings/SettingsParserAlgorithmsTest.java
index cc85c34..d33d112 100644
--- a/src/test/java/ca/islandora/syn/settings/SettingsParserAlgorithmsTest.java
+++ b/src/test/java/ca/islandora/syn/settings/SettingsParserAlgorithmsTest.java
@@ -1,16 +1,19 @@
 package ca.islandora.syn.settings;
 
-import com.auth0.jwt.algorithms.Algorithm;
-import org.junit.Rule;
-import org.junit.Test;
-import org.junit.rules.TemporaryFolder;
+import static org.junit.Assert.assertEquals;
+
 import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.InputStream;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 import java.util.Map;
-import static org.junit.Assert.assertEquals;
+
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.TemporaryFolder;
+
+import com.auth0.jwt.algorithms.Algorithm;
 
 public class SettingsParserAlgorithmsTest {
     @Rule
@@ -179,6 +182,21 @@ public void testSiteNoUrlDefault() throws Exception {
         assertEquals(1, algorithms.size());
     }
 
+    @Test
+    public void testSiteNoUrl() throws Exception {
+        final String testXml = String.join("\n"
+                , "<config version='1'>"
+                , "  <site algorithm='HS256' encoding='plain'>"
+                , "   test data"
+                , "  </site>"
+                , "</config>"
+        );
+
+        final InputStream stream = new ByteArrayInputStream(testXml.getBytes());
+        final Map<String,Algorithm> algorithms = SettingsParser.getSiteAlgorithms(stream);
+        assertEquals(0, algorithms.size());
+    }
+
     private void testOneSiteRsaInlineKey(final String algorithm) throws Exception {
         final String testXml = String.join("\n"
                 , "<config version='1'>"
@@ -256,4 +274,58 @@ public void testOneSiteAllRsaInvalidEncoding() throws Exception {
         final Map<String,Algorithm> algorithms = SettingsParser.getSiteAlgorithms(stream);
         assertEquals(0, algorithms.size());
     }
+
+
+    @Test
+    public void testMultipleDefaults() throws Exception {
+        final File keyFile = temporaryFolder.newFile();
+        final String path = keyFile.getAbsolutePath();
+
+        final String pemPublicKey = String.join("\n"
+                , "-----BEGIN PUBLIC KEY-----"
+                , "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEVO4MNlZG+iGYhoJd/cBpfMd9"
+                , "YnKsntF+zhQs8lCbBabgY8kNoXVIEeOm4WPJ+W53gLDAIg6BNrZqxk9z1TLD6Dmz"
+                , "t176OLYkNoTI9LNf6z4wuBenrlQ/H5UnYl6h5QoOdVpNAgEjkDcdTSOE1lqFLIle"
+                , "KOT4nEF7MBGyOSP3KQIDAQAB"
+                , "-----END PUBLIC KEY-----"
+        );
+
+        Files.write(Paths.get(path), pemPublicKey.getBytes());
+
+        final String testXml = String.join("\n"
+            , "<config version=\"1\">"
+            , "  <site algorithm=\"RS384\" path=\"" + path + "\" encoding=\"PEM\" default=\"true\"/>"
+            , "  <site algorithm=\"HS256\" path=\"" + path + "\" encoding=\"plain\" default=\"true\"/>"
+            , "</config>"
+        );
+        final InputStream stream = new ByteArrayInputStream(testXml.getBytes());
+        final Map<String,Algorithm> algorithms = SettingsParser.getSiteAlgorithms(stream);
+        assertEquals(1, algorithms.size());
+    }
+
+    @Test
+    public void testInvalidAlgorithm() throws Exception {
+        final File keyFile = temporaryFolder.newFile();
+        final String path = keyFile.getAbsolutePath();
+
+        final String pemPublicKey = String.join("\n"
+                , "-----BEGIN PUBLIC KEY-----"
+                , "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEVO4MNlZG+iGYhoJd/cBpfMd9"
+                , "YnKsntF+zhQs8lCbBabgY8kNoXVIEeOm4WPJ+W53gLDAIg6BNrZqxk9z1TLD6Dmz"
+                , "t176OLYkNoTI9LNf6z4wuBenrlQ/H5UnYl6h5QoOdVpNAgEjkDcdTSOE1lqFLIle"
+                , "KOT4nEF7MBGyOSP3KQIDAQAB"
+                , "-----END PUBLIC KEY-----"
+        );
+
+        Files.write(Paths.get(path), pemPublicKey.getBytes());
+
+        final String testXml = String.join("\n"
+            , "<config version=\"1\">"
+            , "  <site algorithm=\"RSA384\" path=\"" + path + "\" encoding=\"PEM\" default=\"true\"/>"
+            , "</config>"
+        );
+        final InputStream stream = new ByteArrayInputStream(testXml.getBytes());
+        final Map<String,Algorithm> algorithms = SettingsParser.getSiteAlgorithms(stream);
+        assertEquals(0, algorithms.size());
+    }
 }
diff --git a/src/test/java/ca/islandora/syn/settings/SettingsParserAnonymousTest.java b/src/test/java/ca/islandora/syn/settings/SettingsParserAnonymousTest.java
new file mode 100644
index 0000000..9c7d321
--- /dev/null
+++ b/src/test/java/ca/islandora/syn/settings/SettingsParserAnonymousTest.java
@@ -0,0 +1,76 @@
+package ca.islandora.syn.settings;
+
+import static org.junit.Assert.assertEquals;
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.util.Map;
+
+import org.junit.Test;
+
+public class SettingsParserAnonymousTest {
+
+    @Test
+    public void testSiteAnonymousOn() throws Exception {
+        final String testXml = String.join("\n"
+            , "<config version='1'>"
+            , "  <site url='http://test.com' algorithm='RS256' encoding='plain' anonymous='true'>"
+            , "   test data"
+            , "  </site>"
+            , "</config>"
+        );
+
+        final InputStream stream = new ByteArrayInputStream(testXml.getBytes());
+        final Map<String, Boolean> anonymous = SettingsParser.getSiteAllowAnonymous(stream);
+        assertEquals(1, anonymous.size());
+        assertEquals(true, anonymous.containsKey("http://test.com"));
+        assertEquals(true, anonymous.get("http://test.com"));
+    }
+
+    @Test
+    public void testSiteMultipleAnonymousTest() throws Exception {
+        final String testXml = String.join("\n"
+            , "<config version='1'>"
+            , "  <site url='http://test.com' algorithm='RS256' encoding='plain' anonymous='true'>"
+            , "   test data"
+            , "  </site>"
+            , "  <site url='http://test2.com' algorithm='RS256' encoding='plain' anonymous='false'>"
+            , "   test data"
+            , "  </site>"
+            , "</config>"
+        );
+
+        final InputStream stream = new ByteArrayInputStream(testXml.getBytes());
+        final Map<String, Boolean> anonymous = SettingsParser.getSiteAllowAnonymous(stream);
+        assertEquals(2, anonymous.size());
+        assertEquals(true, anonymous.containsKey("http://test.com"));
+        assertEquals(true, anonymous.get("http://test.com"));
+        assertEquals(true, anonymous.containsKey("http://test2.com"));
+        assertEquals(false, anonymous.get("http://test2.com"));
+    }
+
+    @Test
+    public void testDefaultMultipleAnonymousTest() throws Exception {
+        final String testXml = String.join("\n"
+            , "<config version='1'>"
+            , "  <site url='http://test.com' algorithm='RS256' encoding='plain' anonymous='true'>"
+            , "   test data"
+            , "  </site>"
+            , "  <site url='http://test2.com' algorithm='RS256' encoding='plain' anonymous='false'>"
+            , "   test data"
+            , "  </site>"
+            , "  <site algorithm='RS256' encoding='plain' anonymous='true' default='true'/>"
+            , "</config>"
+        );
+
+        final InputStream stream = new ByteArrayInputStream(testXml.getBytes());
+        final Map<String, Boolean> anonymous = SettingsParser.getSiteAllowAnonymous(stream);
+        assertEquals(3, anonymous.size());
+        assertEquals(true, anonymous.containsKey("http://test.com"));
+        assertEquals(true, anonymous.get("http://test.com"));
+        assertEquals(true, anonymous.containsKey("http://test2.com"));
+        assertEquals(false, anonymous.get("http://test2.com"));
+        assertEquals(true, anonymous.containsKey("default"));
+        assertEquals(true, anonymous.get("default"));
+    }
+}
diff --git a/src/test/java/ca/islandora/syn/settings/SettingsParserDigestTest.java b/src/test/java/ca/islandora/syn/settings/SettingsParserDigestTest.java
index 91d4249..77daec8 100644
--- a/src/test/java/ca/islandora/syn/settings/SettingsParserDigestTest.java
+++ b/src/test/java/ca/islandora/syn/settings/SettingsParserDigestTest.java
@@ -1,15 +1,15 @@
 package ca.islandora.syn.settings;
 
-import org.junit.Test;
-
-import java.io.ByteArrayInputStream;
-import java.io.InputStream;
-
 import static junit.framework.TestCase.assertFalse;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+
+import org.junit.Test;
+
 public class SettingsParserDigestTest {
 
     @Test
@@ -25,7 +25,7 @@ public void testOneSitePath() throws Exception {
         assertEquals(12, settings.getVersion());
         assertEquals(1, settings.getSites().size());
 
-        final Site site = (Site) settings.getSites().get(0);
+        final Site site = settings.getSites().get(0);
         assertEquals("RS384", site.getAlgorithm());
         assertEquals("http://test.com", site.getUrl());
         assertEquals("test/path.key", site.getPath());
@@ -50,7 +50,7 @@ public void testOneSiteKey() throws Exception {
         assertEquals(-1, settings.getVersion());
         assertEquals(1, settings.getSites().size());
 
-        final Site site = (Site) settings.getSites().get(0);
+        final Site site = settings.getSites().get(0);
         assertEquals("RS384", site.getAlgorithm());
         assertEquals("http://test.com", site.getUrl());
         assertNull(site.getPath());
@@ -83,6 +83,7 @@ public void testOneSiteUnexpectedAttribute() throws Exception {
 
         final InputStream stream = new ByteArrayInputStream(testXml.getBytes());
         final Config settings = SettingsParser.getSitesObject(stream);
+        assertEquals(1, settings.getSites().size());
     }
 
     @Test
@@ -95,5 +96,45 @@ public void testOneSiteUnexpectedTag() throws Exception {
 
         final InputStream stream = new ByteArrayInputStream(testXml.getBytes());
         final Config settings = SettingsParser.getSitesObject(stream);
+        assertEquals(0, settings.getSites().size())
+;    }
+
+    @Test
+    public void testValidAnonymousTrue() throws Exception {
+        final String testXml = "<config>\n" +
+            "  <site url=\"http://test.com\" algorithm=\"RS384\" encoding=\"PEM\" default=\"true\" " +
+            "anonymous=\"true\" />\n" +
+            "</config>";
+
+        final InputStream stream = new ByteArrayInputStream(testXml.getBytes());
+        final Config settings = SettingsParser.getSitesObject(stream);
+        final Site sites = settings.getSites().get(0);
+        assertTrue("Did not set anonymous property", sites.getAnonymous());
+    }
+
+    @Test
+    public void testValidAnonymousFalse() throws Exception {
+        final String testXml = "<config>\n" +
+            "  <site url=\"http://test.com\" algorithm=\"RS384\" encoding=\"PEM\" default=\"true\" " +
+            "anonymous=\"false\" />\n" +
+            "</config>";
+
+        final InputStream stream = new ByteArrayInputStream(testXml.getBytes());
+        final Config settings = SettingsParser.getSitesObject(stream);
+        final Site sites = settings.getSites().get(0);
+        assertFalse("Did not set anonymous property", sites.getAnonymous());
+    }
+
+    @Test
+    public void testInvalidAnonymous() throws Exception {
+        final String testXml = "<config>\n" +
+            "  <site url=\"http://test.com\" algorithm=\"RS384\" encoding=\"PEM\" default=\"true\" " +
+            "anonymous=\"whatever\" />\n" +
+            "</config>";
+
+        final InputStream stream = new ByteArrayInputStream(testXml.getBytes());
+        final Config settings = SettingsParser.getSitesObject(stream);
+        final Site sites = settings.getSites().get(0);
+        assertFalse("Did not set anonymous property", sites.getAnonymous());
     }
 }
diff --git a/src/test/java/ca/islandora/syn/settings/SiteTest.java b/src/test/java/ca/islandora/syn/settings/SiteTest.java
index 0b69954..a754917 100644
--- a/src/test/java/ca/islandora/syn/settings/SiteTest.java
+++ b/src/test/java/ca/islandora/syn/settings/SiteTest.java
@@ -1,13 +1,13 @@
 package ca.islandora.syn.settings;
 
-import org.junit.Before;
-import org.junit.Test;
-
 import static junit.framework.TestCase.assertFalse;
 import static junit.framework.TestCase.assertNull;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 
+import org.junit.Before;
+import org.junit.Test;
+
 public class SiteTest {
     Site site;
 
@@ -64,4 +64,13 @@ public void testSiteDefault() {
         this.site.setDefault(false);
         assertFalse(this.site.getDefault());
     }
+
+    @Test
+    public void testSiteAnonymous() {
+        assertFalse(this.site.getAnonymous());
+        this.site.setAnonymous(true);
+        assertTrue(this.site.getAnonymous());
+        this.site.setAnonymous(false);
+        assertFalse(this.site.getAnonymous());
+    }
 }
diff --git a/src/test/java/ca/islandora/syn/valves/SynValveTest.java b/src/test/java/ca/islandora/syn/valves/SynValveTest.java
index 5eaa6a8..c94d5f4 100644
--- a/src/test/java/ca/islandora/syn/valves/SynValveTest.java
+++ b/src/test/java/ca/islandora/syn/valves/SynValveTest.java
@@ -1,10 +1,26 @@
 package ca.islandora.syn.valves;
 
-import ca.islandora.syn.valve.SynValve;
-import com.auth0.jwt.JWT;
-import com.auth0.jwt.algorithms.Algorithm;
+import static junit.framework.TestCase.assertEquals;
+import static junit.framework.TestCase.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.inOrder;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.io.File;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.time.Instant;
+import java.time.LocalDateTime;
+import java.time.ZoneId;
+import java.time.ZoneOffset;
+import java.util.Arrays;
+import java.util.Date;
+import java.util.List;
+
 import org.apache.catalina.Container;
 import org.apache.catalina.Context;
+import org.apache.catalina.Host;
 import org.apache.catalina.Realm;
 import org.apache.catalina.Valve;
 import org.apache.catalina.connector.Request;
@@ -20,23 +36,11 @@
 import org.mockito.InOrder;
 import org.mockito.Mock;
 import org.mockito.junit.MockitoJUnitRunner;
-import java.io.File;
-import java.nio.file.Files;
-import java.nio.file.Paths;
-import java.time.Instant;
-import java.time.LocalDateTime;
-import java.time.ZoneId;
-import java.time.ZoneOffset;
-import java.util.Arrays;
-import java.util.Date;
-import java.util.List;
 
-import static junit.framework.TestCase.assertEquals;
-import static junit.framework.TestCase.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.mockito.Mockito.inOrder;
-import static org.mockito.Mockito.when;
-import static org.mockito.Mockito.verify;
+import com.auth0.jwt.JWT;
+import com.auth0.jwt.algorithms.Algorithm;
+
+import ca.islandora.syn.valve.SynValve;
 
 @RunWith(MockitoJUnitRunner.class)
 public class SynValveTest {
@@ -64,6 +68,9 @@ public class SynValveTest {
     @Rule
     public TemporaryFolder temporaryFolder = new TemporaryFolder();
 
+    @Mock
+    private Host mockHost;
+
     private static ZoneOffset offset;
 
     @Before
@@ -78,6 +85,7 @@ public void setUp() throws Exception {
 
         when(container.getRealm()).thenReturn(realm);
         when(request.getContext()).thenReturn(context);
+        when(request.getMethod()).thenReturn("POST");
         offset = ZoneId.systemDefault().getRules().getOffset(Instant.now());
     }
 
@@ -95,12 +103,13 @@ public void shouldInvokeNextValveWithoutAuth() throws Exception {
     @Test
     public void shouldPassAuth() throws Exception {
         final ArgumentCaptor<GenericPrincipal> argument = ArgumentCaptor.forClass(GenericPrincipal.class);
+        final String host = "http://test.com";
 
         final String token = "Bearer " + JWT
                 .create()
                 .withClaim("uid", 1)
                 .withClaim("name", "adminuser")
-                .withClaim("url", "http://test.com")
+                .withClaim("url", host)
                 .withArrayClaim("roles", new String[] {"role1", "role2", "role3"})
                 .withIssuedAt(Date.from(LocalDateTime.now().toInstant(offset)))
                 .withExpiresAt(Date.from(LocalDateTime.now().plusHours(2).toInstant(offset)))
@@ -208,10 +217,11 @@ public void shouldFailAuthBecauseOfTokenInvalid2() throws Exception {
 
     @Test
     public void shouldFailTokenMissingUid() throws Exception {
+        final String host = "http://test.com";
         final String token = JWT
                 .create()
                 .withClaim("name", "adminuser")
-                .withClaim("url", "http://test.com")
+                .withClaim("url", host)
                 .withArrayClaim("roles", new String[] {"role1", "role2", "role3"})
                 .withIssuedAt(Date.from(LocalDateTime.now().toInstant(offset)))
                 .withExpiresAt(Date.from(LocalDateTime.now().plusHours(2).toInstant(offset)))
@@ -233,11 +243,12 @@ public void shouldFailTokenMissingUid() throws Exception {
 
     @Test
     public void shouldPassAuthDefaultSite() throws Exception {
+        final String host = "http://test2.com";
         final String token = JWT
                 .create()
                 .withClaim("uid", 1)
                 .withClaim("name", "normalUser")
-                .withClaim("url", "http://test2.com")
+                .withClaim("url", host)
                 .withArrayClaim("roles", new String[] {})
                 .withIssuedAt(Date.from(LocalDateTime.now().toInstant(offset)))
                 .withExpiresAt(Date.from(LocalDateTime.now().plusHours(2).toInstant(offset)))
@@ -271,11 +282,12 @@ public void shouldPassAuthDefaultSite() throws Exception {
 
     @Test
     public void shouldFailAuthBecauseNoSiteMatch() throws Exception {
+        final String host = "http://test-no-match.com";
         final String token = JWT
                 .create()
                 .withClaim("uid", 1)
                 .withClaim("name", "normalUser")
-                .withClaim("url", "http://test-no-match.com")
+                .withClaim("url", host)
                 .withArrayClaim("roles", new String[] {})
                 .withIssuedAt(Date.from(LocalDateTime.now().toInstant(offset)))
                 .withExpiresAt(Date.from(LocalDateTime.now().plusHours(2).toInstant(offset)))
@@ -304,6 +316,314 @@ public void shouldFailAuthBecauseNoSiteMatch() throws Exception {
         verify(response).sendError(401, "Token authentication failed.");
     }
 
+    @Test
+    public void allowAuthWithToken() throws Exception {
+        final String host = "http://anon-test.com";
+        final String token = JWT
+            .create()
+            .withClaim("uid", 1)
+            .withClaim("name", "normalUser")
+            .withClaim("url", host)
+            .withArrayClaim("roles", new String[] {})
+            .withIssuedAt(Date.from(LocalDateTime.now().toInstant(offset)))
+            .withExpiresAt(Date.from(LocalDateTime.now().plusHours(2).toInstant(offset)))
+            .sign(Algorithm.HMAC256("secretFool"));
+
+        final SecurityConstraint securityConstraint = new SecurityConstraint();
+        securityConstraint.setAuthConstraint(true);
+        when(realm.findSecurityConstraints(request, request.getContext()))
+            .thenReturn(new SecurityConstraint[] { securityConstraint });
+        when(request.getHeader("Authorization"))
+            .thenReturn("Bearer " + token);
+
+        final ArgumentCaptor<GenericPrincipal> argument = ArgumentCaptor.forClass(GenericPrincipal.class);
+
+        final String testXml = String.join("\n"
+            , "<config version='1'>"
+            , "  <site url='" + host + "' algorithm='HS256' encoding='plain' anonymous='true'>"
+            , "secretFool"
+            , "  </site>"
+            , "</config>"
+        );
+        Files.write(Paths.get(this.settings.getAbsolutePath()), testXml.getBytes());
+
+        synValve.start();
+        synValve.invoke(request, response);
+
+        final InOrder inOrder = inOrder(request, nextValve);
+        inOrder.verify(request).getHeader("Authorization");
+        inOrder.verify(request).setUserPrincipal(argument.capture());
+        inOrder.verify(request).setAuthType("SYN");
+        inOrder.verify(nextValve).invoke(request, response);
+
+        assertEquals("normalUser", argument.getValue().getName());
+        final List<String> roles = Arrays.asList(argument.getValue().getRoles());
+        assertEquals(2, roles.size());
+        assertTrue(roles.contains("islandora"));
+        assertTrue(roles.contains(host));
+        assertNull(argument.getValue().getPassword());
+    }
+
+    @Test
+    public void allowGetWithoutToken() throws Exception {
+        final String host = "http://anon-test.com";
+        final SecurityConstraint securityConstraint = new SecurityConstraint();
+        securityConstraint.setAuthConstraint(true);
+        when(realm.findSecurityConstraints(request, request.getContext()))
+            .thenReturn(new SecurityConstraint[] { securityConstraint });
+        when(request.getMethod()).thenReturn("GET");
+        when(mockHost.toString()).thenReturn(host);
+        when(request.getHost()).thenReturn(mockHost);
+
+        final ArgumentCaptor<GenericPrincipal> argument = ArgumentCaptor.forClass(GenericPrincipal.class);
+
+        final String testXml = String.join("\n"
+            , "<config version='1'>"
+            , "  <site url='" + host + "' algorithm='HS256' encoding='plain' anonymous='true'>"
+            , "secretFool"
+            , "  </site>"
+            , "</config>"
+        );
+        Files.write(Paths.get(this.settings.getAbsolutePath()), testXml.getBytes());
+
+        synValve.start();
+        synValve.invoke(request, response);
+
+        final InOrder inOrder = inOrder(request, nextValve);
+        inOrder.verify(request).setUserPrincipal(argument.capture());
+        inOrder.verify(nextValve).invoke(request, response);
+
+        assertEquals("anonymous", argument.getValue().getName());
+        final List<String> roles = Arrays.asList(argument.getValue().getRoles());
+        assertEquals(2, roles.size());
+        assertTrue(roles.contains("anonymous"));
+        assertTrue(roles.contains("islandora"));
+        assertNull(argument.getValue().getPassword());
+    }
+
+    @Test
+    public void allowHeadWithoutToken() throws Exception {
+        final String host = "http://anon-test.com";
+        final SecurityConstraint securityConstraint = new SecurityConstraint();
+        securityConstraint.setAuthConstraint(true);
+        when(realm.findSecurityConstraints(request, request.getContext()))
+            .thenReturn(new SecurityConstraint[] { securityConstraint });
+        when(request.getMethod()).thenReturn("HEAD");
+        when(mockHost.toString()).thenReturn(host);
+        when(request.getHost()).thenReturn(mockHost);
+
+        final ArgumentCaptor<GenericPrincipal> argument = ArgumentCaptor.forClass(GenericPrincipal.class);
+
+        final String testXml = String.join("\n"
+            , "<config version='1'>"
+            , "  <site url='" + host + "' algorithm='HS256' encoding='plain' anonymous='true'>"
+            , "secretFool"
+            , "  </site>"
+            , "</config>"
+        );
+        Files.write(Paths.get(this.settings.getAbsolutePath()), testXml.getBytes());
+
+        synValve.start();
+        synValve.invoke(request, response);
+
+        final InOrder inOrder = inOrder(request, nextValve);
+        inOrder.verify(request).setUserPrincipal(argument.capture());
+        inOrder.verify(nextValve).invoke(request, response);
+
+        assertEquals("anonymous", argument.getValue().getName());
+        final List<String> roles = Arrays.asList(argument.getValue().getRoles());
+        assertEquals(2, roles.size());
+        assertTrue(roles.contains("anonymous"));
+        assertTrue(roles.contains("islandora"));
+        assertNull(argument.getValue().getPassword());
+    }
+
+    @Test
+    public void disallowGetWithoutToken() throws Exception {
+        final String host = "http://anon-test.com";
+        final String nohost = "http://other-site.com";
+        final SecurityConstraint securityConstraint = new SecurityConstraint();
+        securityConstraint.setAuthConstraint(true);
+        when(realm.findSecurityConstraints(request, request.getContext()))
+            .thenReturn(new SecurityConstraint[] { securityConstraint });
+        when(request.getMethod()).thenReturn("GET");
+        when(mockHost.toString()).thenReturn(host);
+        when(request.getHost()).thenReturn(mockHost);
+
+        final String testXml = String.join("\n"
+            , "<config version='1'>"
+            , "  <site url='" + nohost + "' algorithm='HS256' encoding='plain'>"
+            , "secretFool"
+            , "  </site>"
+            , "</config>"
+        );
+        Files.write(Paths.get(this.settings.getAbsolutePath()), testXml.getBytes());
+
+        synValve.start();
+        synValve.invoke(request, response);
+
+        verify(request).getHeader("Authorization");
+        verify(response).sendError(401, "Token authentication failed.");
+    }
+
+    @Test
+    public void overrideDefaultAllow() throws Exception {
+        final String host = "http://anon-test.com";
+        final String token = JWT
+            .create()
+            .withClaim("uid", 1)
+            .withClaim("name", "normalUser")
+            .withClaim("url", host)
+            .withArrayClaim("roles", new String[] {})
+            .withIssuedAt(Date.from(LocalDateTime.now().toInstant(offset)))
+            .withExpiresAt(Date.from(LocalDateTime.now().plusHours(2).toInstant(offset)))
+            .sign(Algorithm.HMAC256("secretFool"));
+        final SecurityConstraint securityConstraint = new SecurityConstraint();
+        securityConstraint.setAuthConstraint(true);
+        when(realm.findSecurityConstraints(request, request.getContext()))
+            .thenReturn(new SecurityConstraint[] { securityConstraint });
+        when(request.getHeader("Authorization"))
+            .thenReturn("Bearer " + token);
+        when(request.getMethod()).thenReturn("GET");
+        when(mockHost.toString()).thenReturn(host);
+        when(request.getHost()).thenReturn(mockHost);
+
+        final ArgumentCaptor<GenericPrincipal> argument = ArgumentCaptor.forClass(GenericPrincipal.class);
+
+        final String testXml = String.join("\n"
+            , "<config version='1'>"
+            , "  <site url='" + host + "' algorithm='HS256' encoding='plain' anonymous='false'>"
+            , "secretFool"
+            , "  </site>"
+            , "  <site algorithm='RS256' encoding='plain' anonymous='true' default='true'/>"
+            , "</config>"
+        );
+        Files.write(Paths.get(this.settings.getAbsolutePath()), testXml.getBytes());
+
+        synValve.start();
+        synValve.invoke(request, response);
+
+        final InOrder inOrder = inOrder(request, nextValve);
+        inOrder.verify(request).setUserPrincipal(argument.capture());
+        inOrder.verify(nextValve).invoke(request, response);
+
+        assertEquals("normalUser", argument.getValue().getName());
+        final List<String> roles = Arrays.asList(argument.getValue().getRoles());
+        assertEquals(2, roles.size());
+        assertTrue(roles.contains("islandora"));
+        assertTrue(roles.contains(host));
+        assertNull(argument.getValue().getPassword());
+    }
+
+    @Test
+    public void overrideDefaultDeny() throws Exception {
+        final String host = "http://anon-test.com";
+        final SecurityConstraint securityConstraint = new SecurityConstraint();
+        securityConstraint.setAuthConstraint(true);
+        when(realm.findSecurityConstraints(request, request.getContext()))
+            .thenReturn(new SecurityConstraint[] { securityConstraint });
+        when(request.getMethod()).thenReturn("GET");
+        when(mockHost.toString()).thenReturn(host);
+        when(request.getHost()).thenReturn(mockHost);
+
+        final ArgumentCaptor<GenericPrincipal> argument = ArgumentCaptor.forClass(GenericPrincipal.class);
+
+        final String testXml = String.join("\n"
+            , "<config version='1'>"
+            , "  <site url='" + host + "' algorithm='HS256' encoding='plain' anonymous='true'>"
+            , "secretFool"
+            , "  </site>"
+            , "  <site algorithm='RS256' encoding='plain' anonymous='true' default='false'/>"
+            , "</config>"
+        );
+        Files.write(Paths.get(this.settings.getAbsolutePath()), testXml.getBytes());
+
+        synValve.start();
+        synValve.invoke(request, response);
+
+        final InOrder inOrder = inOrder(request, nextValve);
+        inOrder.verify(request).setUserPrincipal(argument.capture());
+        inOrder.verify(nextValve).invoke(request, response);
+
+        assertEquals("anonymous", argument.getValue().getName());
+        final List<String> roles = Arrays.asList(argument.getValue().getRoles());
+        assertEquals(2, roles.size());
+        assertTrue(roles.contains("anonymous"));
+        assertTrue(roles.contains("islandora"));
+        assertNull(argument.getValue().getPassword());
+    }
+
+    @Test
+    public void defaultAndSiteAllowed() throws Exception {
+        final String host = "http://anon-test.com";
+        final SecurityConstraint securityConstraint = new SecurityConstraint();
+        securityConstraint.setAuthConstraint(true);
+        when(realm.findSecurityConstraints(request, request.getContext()))
+            .thenReturn(new SecurityConstraint[] { securityConstraint });
+        when(request.getMethod()).thenReturn("GET");
+        when(mockHost.toString()).thenReturn(host);
+        when(request.getHost()).thenReturn(mockHost);
+
+        final ArgumentCaptor<GenericPrincipal> argument = ArgumentCaptor.forClass(GenericPrincipal.class);
+
+        final String testXml = String.join("\n"
+            , "<config version='1'>"
+            , "  <site algorithm='RS256' encoding='plain' anonymous='true' default='true'/>"
+            , "</config>"
+        );
+        Files.write(Paths.get(this.settings.getAbsolutePath()), testXml.getBytes());
+
+        synValve.start();
+        synValve.invoke(request, response);
+
+        final InOrder inOrder = inOrder(request, nextValve);
+        inOrder.verify(request).setUserPrincipal(argument.capture());
+        inOrder.verify(nextValve).invoke(request, response);
+
+        assertEquals("anonymous", argument.getValue().getName());
+        final List<String> roles = Arrays.asList(argument.getValue().getRoles());
+        assertEquals(2, roles.size());
+        assertTrue(roles.contains("anonymous"));
+        assertTrue(roles.contains("islandora"));
+        assertNull(argument.getValue().getPassword());
+    }
+
+    @Test
+    public void shouldFailSignatureVerification() throws Exception {
+        final String host = "http://test.com";
+        final String token = JWT
+                .create()
+                .withClaim("uid", 1)
+                .withClaim("name", "normalUser")
+                .withClaim("url", host)
+                .withArrayClaim("roles", new String[] {})
+            .withIssuedAt(Date.from(LocalDateTime.now().toInstant(offset)))
+            .withExpiresAt(Date.from(LocalDateTime.now().plusHours(2).toInstant(offset)))
+                .sign(Algorithm.HMAC256("secret"));
+
+        final SecurityConstraint securityConstraint = new SecurityConstraint();
+        securityConstraint.setAuthConstraint(true);
+        when(realm.findSecurityConstraints(request, request.getContext()))
+                .thenReturn(new SecurityConstraint[] { securityConstraint });
+        when(request.getHeader("Authorization"))
+            .thenReturn("Bearer " + token + "s");
+
+        final String testXml = String.join("\n"
+                , "<config version='1'>"
+                , "  <site url='http://test.com' algorithm='HS256' encoding='plain'>"
+                , "secret"
+                , "  </site>"
+                , "</config>"
+        );
+        Files.write(Paths.get(this.settings.getAbsolutePath()), testXml.getBytes());
+
+        synValve.start();
+        synValve.invoke(request, response);
+
+        verify(request).getHeader("Authorization");
+        verify(response).sendError(401, "Token authentication failed.");
+    }
+
     private void createSettings(final File settingsFile) throws Exception {
         final String testXml = String.join("\n"
                 , "<config version='1'>"