Optionally allow insecure auth urls

Author: MrCreosote

.classpath

@@ -31,6 +31,6 @@
 	<classpathentry kind="lib" path="/jars/lib/jars/logback/logback-classic-1.1.2.jar"/>
 	<classpathentry kind="lib" path="/jars/lib/jars/logback/logback-core-1.1.2.jar"/>
 	<classpathentry kind="lib" path="/jars/lib/jars/joda/joda-time-2.2.jar"/>
-	<classpathentry kind="lib" path="/jars/lib/jars/kbase/auth/kbase-auth-0.4.0.jar"/>
+	<classpathentry kind="lib" path="/jars/lib/jars/kbase/auth/kbase-auth-0.4.2.jar"/>
 	<classpathentry kind="output" path="bin"/>
 </classpath>

RELEASE_NOTES.txt

@@ -4,6 +4,14 @@ OVERVIEW
 -----------------------------------------
 Repo for code shared between Java services.
 
+VERSION: 0.0.21 (Released 8/26/2016)
+--------------------------------------
+
+NEW FEATURES:
+- The Java servers now accept an 'auth-service-url-allow-insecure' parameter in
+  the deployment configuration file. Set to 'true' if using an http url rather
+  than https for the auth service.
+
 VERSION: 0.0.20 (Released 8/5/2016)
 --------------------------------------
 
@@ -14,12 +22,10 @@ UPDATED FEATURES / MAJOR BUG FIXES:
 - Java servers now instantiate an auth client once on startup rather than
   every call (if an auth url is provided in the config). This prevents an
   extra call to the auth service for every server call.
-  
 
 ANTICIPATED FUTURE DEVELOPMENTS:
 - None
 
-
 VERSION: 0.0.19 (Released 8/3/2016)
 --------------------------------------
 

build.xml

@@ -45,7 +45,7 @@
     <include name="jna/jna-3.4.0.jar"/>
     <include name="servlet/servlet-api-2.5.jar"/>
     <include name="syslog4j/syslog4j-0.9.46.jar"/>
-    <include name="kbase/auth/kbase-auth-0.4.0.jar"/>
+    <include name="kbase/auth/kbase-auth-0.4.2.jar"/>
     <include name="texttable/text-table-formatter-1.1.1.jar"/>
     <include name="apache_commons/http/httpclient-4.3.1.jar"/>
     <include name="apache_commons/http/httpcore-4.3.jar"/>

src/us/kbase/common/service/JsonServerServlet.java

@@ -79,7 +79,11 @@ public class JsonServerServlet extends HttpServlet {
 	 * the server name.
 	 */
 	public static final String KB_SERVNAME = "KB_SERVICE_NAME";
-	private static final String CONFIG_AUTH_SERVICE_URL_PARAM = "auth-service-url";
+	private static final String CONFIG_AUTH_SERVICE_URL_PARAM =
+			"auth-service-url";
+	//set to 'true' for true, anything else for false.
+	private static final String CONFIG_AUTH_SERVICE_ALLOW_INSECURE_URL_PARAM =
+			"auth-service-url-allow-insecure";
 	private static final String KB_JOB_SERVICE_URL = "KB_JOB_SERVICE_URL";
 	private static final String CONFIG_JOB_SERVICE_URL_PARAM = "job-service-url";
 	private final ConfigurableAuthService auth;
@@ -174,12 +178,14 @@ public JsonServerServlet(String specServiceName) {
 
 	private ConfigurableAuthService getAuth(final Map<String, String> config) {
 		final String authURL = config.get(CONFIG_AUTH_SERVICE_URL_PARAM);
-		final AuthConfig c;
-		if (authURL == null || authURL.isEmpty()) {
-			c = new AuthConfig();
-		} else {
+		final AuthConfig c = new AuthConfig();
+		if (authURL != null && !authURL.isEmpty()) {
+			if (STRING_TRUE.equals(config.get(
+					CONFIG_AUTH_SERVICE_ALLOW_INSECURE_URL_PARAM))) {
+				c.withAllowInsecureURLs(true);
+			}
 			try {
-				c = new AuthConfig().withKBaseAuthServerURL(new URL(authURL));
+				c.withKBaseAuthServerURL(new URL(authURL));
 			} catch (URISyntaxException | MalformedURLException e) {
 				startupFailed();
 				sysLogger.logErr(String.format(