Authentication and Automation APIs
I am a bit confused about how authentication works with the Java automation APIs. I would like to use a shared secret between the client and the server, and to use impersonation when a client request comes in to switch the the requesting user's security context. I also need to authenticate the user. Roughly I am trying something along those lines:
// client init
session = client.getSession("Administrator", "Administrator"); // will replace with shared secret
// request comes in from user Bob
session.verifyCredentials("bob", bob's password) // how do I do this??
session.newRequest("Auth.LoginAs").set("name", "bob");
session.do_some_stuff()
session.newRequest("Auth.Logout");
I have two issues:
- How can I validate Bob's credentials (without starting a new session, which is too slow)?
- after Auth.LoginAs, I can still successfully use the session to readDocument for which Bob has been denied the READ permission - is LoginAs really impersonating the user?
Thanks!
0 votes
0 answers
2011 views
franck102
Looking into the source code it seems that LoginAs would work only if I chain it with my "do_some_stuff" on the server side… however that doesn't work well for me, I would need to define automation chains for every operation I ever want to use. I guess what I would need is something like session.newRequest("Auth.LoginAs").set("name","bob").chain("Document.Query").set(…).execute() to create a dynamic chain from the client side?
11/09/2012
franck102
I finally realized that establishing a session is really fast (as opposed to creating a new automation client), so I don't actually have a need for impersonation.
11/12/2012