RESTful client without credential

Hi Team,

Is it possible to call the DCTM rest custom resource without sending the user credentials in client request?

We have created one custom resource "customObjects" this call the SBO and then create the document using ContentfulObject method. We have requirement that user (client user) should not aware about the credentials and it should not pass through the HTTP URL. Instead of this we create the session through the custom resource.

Thanks,

Santosh

Find more posts tagged with

Note:

If there are Accepted Answers, those will be shown by default. You can switch to 'All Replies' by selecting the tab below.

Accepted answers

abc123

Hi Santosh,

When you comment out rest-api-${rest.security.auth.mode}-security.xml, all out-of-the-box resources will be impacted. So I would still suggest to add HTTP none security for your specific custom resource URL pattern first (to Spring security, your custom service is anonymous), then you need to create the DFC session manager in your controller in a way that the persistence managers can work. The magic is to set RepositoryContextHolder after the success of your custom authentication. The persistence managers will leverage RepositoryContextHolder to get/create the session manager. Code examples are shown below.

RepositoryContextHolder.setLoginName(authResult.getPrincipal());

RepositoryContextHolder.setPassword(authResult.getCredentials());

RepositoryContextHolder.setAuthType(AuthType.PASSWORD);

We support a lot of authentication types, so the credentials passed to setPassword() method depends on the AuthType.

Again, we haven't open the security development APIs yet. The next REST release will provide a lot of convenience in this area.

Regards,

William

All comments

abc123

Hi Santosh,

Currently all resources under URL path /repositories/** requires the authentication. If you want to make your custom resource anonymous access, you need to exclude the specific resource URL pattern from Spring security XML configuration.

Documentum REST 7.2 does not provide users a formal way to customize the security yet. It's our plan for 7.3.

One workaround is to look at the rest-base-security.xml under the WAR class-path, and add the <http security="none"/> for your specific resource URL. Please note that this is just a workaround and may be broken after REST is upgraded to 7.3.

Regards,

William

SantoshJha

Thanks William, I will try your suggestion.

SantoshJha

Hi Willian,

We don't want to provide anonymous access for custom resource. We just want that Custom resource should create session from property file that would be part of REST Services instead of coming in the request. I had commented out the bean rest-api-${rest.security.auth.mode}-security.xml in the rest-base-security.xml.

Now I am able to call custom resource without authentication and able to create session as well but when I am calling method createSysObjectUnderParentFolder to create contentful object then getting null as session. Because it try to get session from memory.

I want to call this method with our custom session. Does it possible? If yes then how can I implement it?

Appreciate your help in Advance.

Thanks,

Santosh

abc123

Hi Santosh,

RepositoryContextHolder.setLoginName(authResult.getPrincipal());

RepositoryContextHolder.setPassword(authResult.getCredentials());

RepositoryContextHolder.setAuthType(AuthType.PASSWORD);

We support a lot of authentication types, so the credentials passed to setPassword() method depends on the AuthType.

Again, we haven't open the security development APIs yet. The next REST release will provide a lot of convenience in this area.

Regards,

William

SantoshJha

Hi William,

Yes, magic worked for me. Thanks for providing the instruction.

I was using method RepositoryContextHolder.setContextSession(session); and it was not working.

Thanks,

Santosh

scdof

Hi William,

I see you reply for rest 7.2 creating session inside custom service. Do you have any samples for rest 7.3 for Custom resource which should create session from property file, if so could you please share it.

Hicham Bahi

If you use the preauth authentication scheme, it will first try to read the credentials of a technical superuser located in file trust.properties. If this file is not present, it will try to login using trusted login but this requires that the DFC used by Documentum REST be privileged (see Content Server Admin and Config guide for details).