REST Webservices security

Question

I am trying to set up the REST Webservices module, but I seem to be running into issues with security and authentication. I can get sessions from the client side properly, but I cannot call any methods on components.
*/atg/rest/security/restSecurityConfiguration.xml*
<programlisting>
  <rest-security>
    <default-acl value="EVERYONE:read,write,execute"/>
      <resource component="/path/to/component/TestComponent" secure="false" requiresSessionConfirmation="false">
        <method name="getTestComponentName" secure="false">
          <acl value="EVERYONE:read,write,execute" />
        </method>
      </resource>
  </rest-security>
</programlisting>
TestComponent.java
public class TestComponent {
  public String getTestComponentName() {
    return this.getClass().getCanonicalName();
}I have turned on the DEBUG level logging in ACC for the RestSecurityProcessor and this is what I see in my logs when I try to access my TestComponent (which is just testing to see if I have access to methods):
INFO  [RestSecurityProcessor] DEBUG Received POST request for
INFO  [RestSecurityProcessor] DEBUG Resource container is valid component. Returning true.
INFO  [RestSecurityProcessor] DEBUG handlePostRequest: Handling component /path/to/component/TestComponent
INFO  [RestSecurityProcessor] DEBUG getParentSecurityConfiguration: Looking for wild card ComponentSecurityConfiguration for component /path/to/component/TestComponent
INFO  [RestSecurityProcessor] DEBUG getParentSecurityConfiguration: Looking for default ComponentSecurityConfiguration
INFO  [RestSecurityProcessor] DEBUG handlePostRequest: Can't find ComponentSecurityConfiguration for component /path/to/component/TestComponent
ERROR [RestSecurityServlet] Error code: 401
Access to the requested resource is not allowed: /path/to/component/TestComponent
atg.rest.RestException: Access to the requested resource is not allowed: /path/to/component/TestComponent
     at atg.rest.processor.RestSecurityProcessor.handlePostRequest(RestSecurityProcessor.java:315)
     at atg.rest.processor.RestSecurityProcessor.doRESTPost(RestSecurityProcessor.java:208)
     at atg.rest.servlet.RestPipelineServlet.serviceRESTRequest(RestPipelineServlet.java:406)
*snip*Edited by: Gommy on Apr 8, 2013 6:19 AM - Fix typo in package path

Answer 1

After finding a default restSecurityConfiguration.xml inside of REST/config.jar:/atg/rest/security/, I located a .dtd ( http://www.atg.com/dtds/rest/restSecurity_1.0.dtd ) to figure out what exactly ATG was expecting for a configuration.
1. Turns out the <programlisting> tag isn't expected (error in the documentation for our version of ATG, apparently), <rest-security> is the top-level element for this configuration file. This was causing the file to not be parsed at all.
2. requiresSessionConfirmation does not exist on the resource element.
The TestComponent and its properties were correct. Just the restSecurityConfiguration.xml was incorrect due to very poor documentation, no full example to see what a correct file should look like, and lack of obvious schemas (i.e., no schemas or links to schemas are provided in any documentation) to validate against.