REST api with Kerberos SSO

Hi,

I'm trying to use the REST API to retrieve information on a given node (api/v1/nodes/2000). Our installation is entirely configured to use SSO with Kerberos and it works quite well everywhere except for REST API that seems to absolutely require that we pass in the username and password to the auth function before doing anything.

Am I missing something?

Find more posts tagged with

Comments

Pramod Mohandas

Nothing wrong.

Assuming that you’re trying to consume the APIs from outside CS, it has always been the case that you would need to first authenticate the user against CS before performing any additional actions.

The scenario would be different in case you’re accessing CS via AppWorks. Then, you would already have the said authentication token for processing without the need to reauthenticate. If you have OTDS in place, you would still need credentials of otadmin@otds.admin to be able to impersonate the intended user against the Content Server OTDS resource. CS UI widgets do not need any such reauthentication either while using REST.

- Pramod Mohandas

bkqc

So do I understand correctly if I say that I will be forced to fallback to either using SOAP or emulating standard web calls to continue to give SSO to my users? If it is the cas, it is a bit crazy, I think... Especially since SSO works everywhere else (GUI, WS, Search-API).

Ferdinand Prantl

Louis, does your application run in a web browser and makes AJAX requests, or is it a back-end application doing server-to-server communication?

micfoste_wl

Agreed. SSO should be the first method of authenticating.

Ferdinand Prantl

CS REST API is not authenticated automatically by cookies (SSO) to prevent CSRF. To get advantage of SSO in an applicatoin, which uses CS REST API, set up SSO with OTDS. You will be able to get OTDSTicket for CS then, which CS REST API accepts as authentication header.

Jean Philippe Forti

Tools needed:

Postman installed as a Chrome app (https://www.getpostman.com/)

Content Server instance CS version 10 Update 2015-09 or greater.

Let's assume ecm is your Content Server virtual directory with SSO enabled on IIS.

How to use:

Get an authentication token (POST):

http://yourservername/ecm/llisapi.dll/api/v1/auth

Body parameter: username and password (leave them empty for SSO)

The result is:

{
"ticket": "PoxISgKIG/nIF41BkZ8otGyOQVQTxI0bMZRstyh6akCXHYkd28gEfhB8dK2j3h3p"
}

Note: With a non SSO virtual directory you must fill the username and password. It works only for users with Basic Authentication (where the password is stored in the kuaf table).

Take note of this token.

Send a request to get information on a folder for example (GET)

url: http://<yourservername>/ecm/llisapi.dll/api/v1/nodes/<folder id>

Header parameter: OTCSTICKET=<your authentication token>

The result is a JSon array.

dluo

May I ask how to make "SSO virtual directory" available? In our CS 10.5 setup, call "/api/v1/auth" with empty username and password is treated as bad request. We have SSO, so I figure "SSO virtual directory" is probally not configured.