X-Git-Url: https://gerrit.onap.org/r/gitweb?a=blobdiff_plain;f=auth%2Fauth-service%2Fsrc%2Fmain%2Fjava%2Forg%2Fonap%2Faaf%2Fauth%2Fservice%2Fapi%2FAPI_Creds.java;h=fbc1baa245c4fe93e356eaac36b31b40b0d076a4;hb=07fb3ece74a9aa1fad8e2a9fab73b4de3e36853b;hp=964a05229a24f749079f111f2845c7cddbbdd3d1;hpb=e42ec75a7229ceecff749fd36bdc2b5f86357749;p=aaf%2Fauthz.git

diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Creds.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Creds.java
index 964a0522..fbc1baa2 100644
--- a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Creds.java
+++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Creds.java
@@ -100,7 +100,7 @@ public class API_Creds {
                                 if (cv.validate(bp.getName(), Type.PASSWORD, bp.getCred(), null) ) {
                                     resp.setStatus(HttpStatus.OK_200);
                                 } else {
-                                    resp.setStatus(HttpStatus.FORBIDDEN_403);
+                                    resp.setStatus(HttpStatus.UNAUTHORIZED_401);
                                 }
                             }
                         } else {
@@ -112,7 +112,6 @@ public class API_Creds {
                                         decoded.substring(0,colon), 
                                         CredVal.Type.PASSWORD , 
                                         decoded.substring(colon+1).getBytes(),trans)) {
-                                    
                                     resp.setStatus(HttpStatus.OK_200);
                                 } else {
                                     // DME2 at this version crashes without some sort of response
@@ -144,14 +143,16 @@ public class API_Creds {
                     AuthzTrans trans, 
                     HttpServletRequest req,
                     HttpServletResponse resp) throws Exception {
-                
+                // will be a valid Entity.  Do we need to add permission
+            	//if(trans.fish("ns","password","request")) or the like
                 Result<Date> r = context.doesCredentialMatch(trans, req, resp);
                 if (r.isOK()) {
                     resp.setStatus(HttpStatus.OK_200);
                 } else {
                     // For Security, we don't give any info out on why failed, other than forbidden
                     // Can't do "401", because that is on the call itself
-                    resp.setStatus(HttpStatus.FORBIDDEN_403);
+                	// 403 Implies you MAY NOT Ask.
+                    resp.setStatus(HttpStatus.NOT_ACCEPTABLE_406);
                 }
             }
         });  
@@ -195,7 +196,7 @@ public class API_Creds {
         authzAPI.route(POST,"/authn/cred",API.CRED_REQ,new Code(facade,"Add a New ID/Credential", true) {
             @Override
             public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception {                
-            	Result<Void> r = context.createUserCred(trans, req);
+                Result<Void> r = context.createUserCred(trans, req);
                 if (r.isOK()) {
                     resp.setStatus(HttpStatus.CREATED_201);
                 } else {