The PKIRealm uses a URI matcher to match the incoming request URI with the mappings defined in auth.properties in order to determine the ACI of the resource being accessed.

The current URI matcher implementation has some limitations:

• It doesn't support wildcards, so it's not possible to match pattern such as "/certrequests/{id}/approve".
• It will return the first match, which may not necessarily be the longest match. For example /a/b/c may match /a first, but the best match should have been /a/b.

Once this is fixed, the ACI should be fixed to support more granular access controls for different methods in the same resource. For example:

• /kra/rest/keyrequests/{id}/
• /kra/rest/keyrequests/archive
• /kra/rest/keyrequests/recover

Another option is to use roles as described in ticket #258 and method-level access control using RESTEasy.